raccoon | 1c32ebcede2e7e29f1619b2d03315ea9dff73a29bb7ee4264348ac7763c4892c | Triage

Submit
Reports

Overview

overview

Static

static

3

1edd2d8bc6...18.exe

windows7-x64

1edd2d8bc6...18.exe

windows10-2004-x64

Sharing

General

Target

1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118
Size

1.9MB
Sample

241008-byqgvawema
MD5

1edd2d8bc6c3f7788b80b83e6a58d5c1
SHA1

9f08017abf2e95b36e5b194266a6edfa10d95472
SHA256

1c32ebcede2e7e29f1619b2d03315ea9dff73a29bb7ee4264348ac7763c4892c
SHA512

544d1f9f78e6e88733623d19129a183ec95d8f2992e50f7d39d01b74c9b4f7176bd058aeaf7a7ced1422a7d5be00b954bb09e88f52bd7eb5883c6ee9e22dba61
SSDEEP

49152:l6bRBnd1gAlhlopDii+wjzG9E4DVOfFo/kdFP9YzofnetUm7jO86:l6bRBnd1gAlhlqiinja9B02kXP9YsveX

Score

10^/10

raccoon discovery evasion stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118.exe

Resource

win7-20240903-en

raccoon discovery evasion stealer

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118.exe

Resource

win10v2004-20241007-en

raccoon discovery evasion stealer

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  1edd2d8bc6c3f7788b80b83e6a58d5c1
- SHA1
  
  9f08017abf2e95b36e5b194266a6edfa10d95472
- SHA256
  
  1c32ebcede2e7e29f1619b2d03315ea9dff73a29bb7ee4264348ac7763c4892c
- SHA512
  
  544d1f9f78e6e88733623d19129a183ec95d8f2992e50f7d39d01b74c9b4f7176bd058aeaf7a7ced1422a7d5be00b954bb09e88f52bd7eb5883c6ee9e22dba61
- SSDEEP
  
  49152:l6bRBnd1gAlhlopDii+wjzG9E4DVOfFo/kdFP9YzofnetUm7jO86:l6bRBnd1gAlhlqiinja9B02kXP9YsveX
Score

10^/10

raccoon discovery evasion stealer
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer V1 payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

raccoondiscoveryevasionstealer

behavioral2

raccoondiscoveryevasionstealer

© 2018-2024

Terms | Privacy