General

  • Target

    file.exe

  • Size

    1.6MB

  • Sample

    240913-pq62hs1fqh

  • MD5

    a11d579c5bd5589c82fcf263519b038a

  • SHA1

    8b728cd41c9e43122228ee58f890ecad1db20b82

  • SHA256

    c98d20df81567c0b314ba81bb8deb937eb385eccc352fa61258c58800d53a3d6

  • SHA512

    36bb6b900a43df3f4b003fa50e7d1e228eb3e9e4fdfdfb11dc6710cc618b8999a4703e9cf702ee4acdc67ea93aa1e5654d9a3eb2923514ac92c928e3829798ee

  • SSDEEP

    24576:XBS5YMxUU0jQApp/rGCOVCFZ/Jb4m8W2uX75U/yj0yfFLXh1mnOWqZ:XBS5YMxwL/pUa5/n2urK/YV9R1iOW

Malware Config

Extracted

Family

raccoon

Botnet

4e847b07368a85ebd0a57e614b4bffb9

C2

https://192.153.57.177:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      file.exe

    • Size

      1.6MB

    • MD5

      a11d579c5bd5589c82fcf263519b038a

    • SHA1

      8b728cd41c9e43122228ee58f890ecad1db20b82

    • SHA256

      c98d20df81567c0b314ba81bb8deb937eb385eccc352fa61258c58800d53a3d6

    • SHA512

      36bb6b900a43df3f4b003fa50e7d1e228eb3e9e4fdfdfb11dc6710cc618b8999a4703e9cf702ee4acdc67ea93aa1e5654d9a3eb2923514ac92c928e3829798ee

    • SSDEEP

      24576:XBS5YMxUU0jQApp/rGCOVCFZ/Jb4m8W2uX75U/yj0yfFLXh1mnOWqZ:XBS5YMxwL/pUa5/n2urK/YV9R1iOW

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks