General

  • Target

    NEAS.8ba0b135c0f49d0f5728abf76685df7106c3ac2532b604123a34a238102cdabbexe_JC.exe

  • Size

    8.6MB

  • Sample

    241105-1dktas1qar

  • MD5

    c451a852788a27f30b7ad22a17e106a3

  • SHA1

    4ef303ab3fbe365077f489409104673e71c741b4

  • SHA256

    8ba0b135c0f49d0f5728abf76685df7106c3ac2532b604123a34a238102cdabb

  • SHA512

    1155e9272f3b48b1d841c29286b3b235a664dab9ce692b7a7827b04d5d96adc20dff91ac97ccd06fab73d443546b87ec2fae98fa90dac0dcf39f71a06b4e5344

  • SSDEEP

    196608:IZ73NmtPw6dFZNTRn4tNmtPw6dFZNTBVRO2nLBzMRr/:It30d3Zr4t0d3Z3O21MRL

Malware Config

Extracted

Family

raccoon

Botnet

66abb93700da7ce4fb9f52da912f5cf3

C2

http://45.61.138.198:80/

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Targets

    • Target

      NEAS.8ba0b135c0f49d0f5728abf76685df7106c3ac2532b604123a34a238102cdabbexe_JC.exe

    • Size

      8.6MB

    • MD5

      c451a852788a27f30b7ad22a17e106a3

    • SHA1

      4ef303ab3fbe365077f489409104673e71c741b4

    • SHA256

      8ba0b135c0f49d0f5728abf76685df7106c3ac2532b604123a34a238102cdabb

    • SHA512

      1155e9272f3b48b1d841c29286b3b235a664dab9ce692b7a7827b04d5d96adc20dff91ac97ccd06fab73d443546b87ec2fae98fa90dac0dcf39f71a06b4e5344

    • SSDEEP

      196608:IZ73NmtPw6dFZNTRn4tNmtPw6dFZNTBVRO2nLBzMRr/:It30d3Zr4t0d3Z3O21MRL

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks