Overview

overview

10

Static

static

3

d3a88ab037...0N.exe

windows7-x64

3

d3a88ab037...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d3a88ab037be1a370dc7e5e637755df0N.exe
  • Size 596KB
  • Sample240901-vfxmzsweql
  • SHA256 ae5f4ca290fade383b6236a1c025027c4fc1247242a13e12f12e7f6be67f63a3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
raccoon51b6734addd400a71cf82ae03c984c90credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

  • raccoon

Botnet

  • 51b6734addd400a71cf82ae03c984c90

C2

  • http://116.203.232.114:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target
      d3a88ab037be1a370dc7e5e637755df0N.exe
    • Size 596KB
    • SHA256 ae5f4ca290fade383b6236a1c025027c4fc1247242a13e12f12e7f6be67f63a3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryraccoon51b6734addd400a71cf82ae03c984c90credential_accessspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks