General

  • Target

    194620476ff575534a3cc834440963ff8682307a.rl

  • Size

    80KB

  • Sample

    241026-t1g8cstncp

  • MD5

    75cc82d3cf334c82ac92d55e34459f92

  • SHA1

    194620476ff575534a3cc834440963ff8682307a

  • SHA256

    6bd19bc9223d33208733d5cc07f89bf2943210933424018afa6c2d2e2949811d

  • SHA512

    3994542ed0358a16423839873b292439a0a506aadc4d5acdd884cf76bdcecf30fb1eb093bf67d8c86928392031a317e546c853de1a6f607fe3444dd961f717e1

  • SSDEEP

    1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3QFqH:9PI6GWpeVsXCLMrxbQOpAFqH

Malware Config

Extracted

Family

raccoon

Botnet

970bd7b21ef58eba844bcc1b35da559a

C2

http://193.187.174.250:80/

http://176.113.115.103:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      194620476ff575534a3cc834440963ff8682307a.rl

    • Size

      80KB

    • MD5

      75cc82d3cf334c82ac92d55e34459f92

    • SHA1

      194620476ff575534a3cc834440963ff8682307a

    • SHA256

      6bd19bc9223d33208733d5cc07f89bf2943210933424018afa6c2d2e2949811d

    • SHA512

      3994542ed0358a16423839873b292439a0a506aadc4d5acdd884cf76bdcecf30fb1eb093bf67d8c86928392031a317e546c853de1a6f607fe3444dd961f717e1

    • SSDEEP

      1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3QFqH:9PI6GWpeVsXCLMrxbQOpAFqH

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks