General

  • Target

    dbef01c75b62431ede6a2b2b1e595771c71b4782700094048fc98b86c0e4fbac.exe

  • Size

    337KB

  • Sample

    240928-ccna2atbrf

  • MD5

    4ac138770d03156be9e06ae8b15c1db7

  • SHA1

    43b48c74f3add50868ac8fe1272f15373a35ad4b

  • SHA256

    dbef01c75b62431ede6a2b2b1e595771c71b4782700094048fc98b86c0e4fbac

  • SHA512

    7cd6c64aa080e49511abb33027bef723ccbd21a30e09b05326e25d9d4efb8fa4aee9d1324bf758120ecfead39a9883dd56fe72406048aa259a7afe35b54f397e

  • SSDEEP

    3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv6:0Z8Ow8GFC5W3mTvWChzlS41Rm

Malware Config

Extracted

Family

raccoon

Botnet

970bd7b21ef58eba844bcc1b35da559a

C2

http://193.187.174.250:80/

http://176.113.115.103:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      dbef01c75b62431ede6a2b2b1e595771c71b4782700094048fc98b86c0e4fbac.exe

    • Size

      337KB

    • MD5

      4ac138770d03156be9e06ae8b15c1db7

    • SHA1

      43b48c74f3add50868ac8fe1272f15373a35ad4b

    • SHA256

      dbef01c75b62431ede6a2b2b1e595771c71b4782700094048fc98b86c0e4fbac

    • SHA512

      7cd6c64aa080e49511abb33027bef723ccbd21a30e09b05326e25d9d4efb8fa4aee9d1324bf758120ecfead39a9883dd56fe72406048aa259a7afe35b54f397e

    • SSDEEP

      3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv6:0Z8Ow8GFC5W3mTvWChzlS41Rm

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks