raccoon | 18efcaf65d07160fd0dc967c8303946981aad1a1ca5c6ad9ee5815c34cacde0e | Triage

Submit
Reports

Overview

overview

Static

static

7

c15a34f4a4...18.exe

windows7-x64

c15a34f4a4...18.exe

windows10-2004-x64

Sharing

General

Target

c15a34f4a416bd5e37575a1ac2d013c9_JaffaCakes118
Size

1.8MB
Sample

240825-xfwrssyeqb
MD5

c15a34f4a416bd5e37575a1ac2d013c9
SHA1

70857e856bb17deafa260c0db298137cb55873c5
SHA256

18efcaf65d07160fd0dc967c8303946981aad1a1ca5c6ad9ee5815c34cacde0e
SHA512

d81d4f1ba77bc07590641697c135290a07d6b8895e081d06134a9cdd13d42d0b295b3ef0aa7fd576d51b60d062ccab9119fecdbd1afe5e01684a1cff8f58804f
SSDEEP

24576:rT7AC5h5fd9D0mzmjC0ejRBqkYAqYh+GcJTAigI3OE9ORXKu/2RYIe2KyWeu+u2I:jAS7fQRCD3dfwGA3gqOmc2RLe2anoGb

Score

10^/10

raccoon discovery evasion stealer themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

c15a34f4a416bd5e37575a1ac2d013c9_JaffaCakes118.exe

Resource

win7-20240705-en

raccoon discovery evasion stealer themida trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

c15a34f4a416bd5e37575a1ac2d013c9_JaffaCakes118.exe

Resource

win10v2004-20240802-en

raccoon discovery evasion stealer themida trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  c15a34f4a416bd5e37575a1ac2d013c9_JaffaCakes118
- Size
  
  1.8MB
- MD5
  
  c15a34f4a416bd5e37575a1ac2d013c9
- SHA1
  
  70857e856bb17deafa260c0db298137cb55873c5
- SHA256
  
  18efcaf65d07160fd0dc967c8303946981aad1a1ca5c6ad9ee5815c34cacde0e
- SHA512
  
  d81d4f1ba77bc07590641697c135290a07d6b8895e081d06134a9cdd13d42d0b295b3ef0aa7fd576d51b60d062ccab9119fecdbd1afe5e01684a1cff8f58804f
- SSDEEP
  
  24576:rT7AC5h5fd9D0mzmjC0ejRBqkYAqYh+GcJTAigI3OE9ORXKu/2RYIe2KyWeu+u2I:jAS7fQRCD3dfwGA3gqOmc2RLe2anoGb
Score

10^/10

raccoon discovery evasion stealer themida trojan
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer V1 payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

raccoondiscoveryevasionstealerthemidatrojan

behavioral2

raccoondiscoveryevasionstealerthemidatrojan

© 2018-2024

Terms | Privacy