General

  • Target

    1aa954280ff704582990fa686a91f1d142b21000a36a5.exe

  • Size

    17.9MB

  • Sample

    241012-tvtn7szarf

  • MD5

    48b7e5a3b1f5ffb2aaecc7ff5d8e3d97

  • SHA1

    689aeb40df545d3ef9f0dbe85cca836a6d0ce8f5

  • SHA256

    1aa954280ff704582990fa686a91f1d142b21000a36a55794cb5dfba05274eb5

  • SHA512

    c984e1888c847aada0f5e5eeabcee8ebbce66ba86dde46e00bff47e90ba2cf44585758c021f3d19098b161abb9d22a0249250ac67ea5f73bbed455344ab8196c

  • SSDEEP

    393216:aV+4mXtJ0Nm8ealfbIX8vEBQvefBj0Mos7hvvTXv3s6x6TmJfSg:s2SmwDIMSVBwMf9Hjv3sBTm0g

Malware Config

Extracted

Family

raccoon

Botnet

5937a1bd499cd3cb596ec1995a9baf6a

C2

http://94.228.169.161:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      1aa954280ff704582990fa686a91f1d142b21000a36a5.exe

    • Size

      17.9MB

    • MD5

      48b7e5a3b1f5ffb2aaecc7ff5d8e3d97

    • SHA1

      689aeb40df545d3ef9f0dbe85cca836a6d0ce8f5

    • SHA256

      1aa954280ff704582990fa686a91f1d142b21000a36a55794cb5dfba05274eb5

    • SHA512

      c984e1888c847aada0f5e5eeabcee8ebbce66ba86dde46e00bff47e90ba2cf44585758c021f3d19098b161abb9d22a0249250ac67ea5f73bbed455344ab8196c

    • SSDEEP

      393216:aV+4mXtJ0Nm8ealfbIX8vEBQvefBj0Mos7hvvTXv3s6x6TmJfSg:s2SmwDIMSVBwMf9Hjv3sBTm0g

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks