General

  • Target

    wrapper_jre_offline.exe

  • Size

    19.2MB

  • Sample

    241012-tylsrszcmd

  • MD5

    641d6655a3e29cc7614c8b957862e1c4

  • SHA1

    62e64aa2c9350b595d464a9b86b7523c908b89f5

  • SHA256

    c059b783b68ef84c1743e29fc176231e88de977eddb9b78a92c2327a811875c6

  • SHA512

    3f1036bcbb51ce7881ba87d9e92a12e7c3488640233205eb2f51e6af8b31906bf939a303b339b915f59cace99171a4688c755207d0c9640511b7d6b804ab200c

  • SSDEEP

    393216:Tlss9NuVHhMhFq4h5kC9h/gx4R+l5iq8SI1uIb:X9ghIfh5kCPIKiL8W

Malware Config

Extracted

Family

raccoon

Botnet

5937a1bd499cd3cb596ec1995a9baf6a

C2

http://94.228.169.161:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      wrapper_jre_offline.exe

    • Size

      19.2MB

    • MD5

      641d6655a3e29cc7614c8b957862e1c4

    • SHA1

      62e64aa2c9350b595d464a9b86b7523c908b89f5

    • SHA256

      c059b783b68ef84c1743e29fc176231e88de977eddb9b78a92c2327a811875c6

    • SHA512

      3f1036bcbb51ce7881ba87d9e92a12e7c3488640233205eb2f51e6af8b31906bf939a303b339b915f59cace99171a4688c755207d0c9640511b7d6b804ab200c

    • SSDEEP

      393216:Tlss9NuVHhMhFq4h5kC9h/gx4R+l5iq8SI1uIb:X9ghIfh5kCPIKiL8W

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks