General

  • Target

    aa2cae824c23fc15f2ef9fd64e369a78d49f1a068737a01c7697bae442971410

  • Size

    1.6MB

  • Sample

    241219-em2braxjgs

  • MD5

    a1b876e3a538a90e720d9b2ba7fbfd71

  • SHA1

    a3745731e1bdae7a22d623633b4c638f74e2b8a8

  • SHA256

    aa2cae824c23fc15f2ef9fd64e369a78d49f1a068737a01c7697bae442971410

  • SHA512

    689ba73d0d19fb559ba00b0690673071f9a16c976c0db0a70e977ea6c10db852d6f1d594fc7b8b49c3fabbddf49021f425f2c9dc9387f5dd1791f4dba1f9314a

  • SSDEEP

    24576:987Ezl5WChST3zxyDR0KUewtUQ398MmYSWD/58zLEeJthK2r/xYEisxMr4/6zLiU:G4l5WChSTfKUeaFyhthD/Lj5

Malware Config

Extracted

Family

raccoon

Botnet

d5b70ffd1fb1321864a37f749464c61d

C2

http://192.153.57.177:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      aa2cae824c23fc15f2ef9fd64e369a78d49f1a068737a01c7697bae442971410

    • Size

      1.6MB

    • MD5

      a1b876e3a538a90e720d9b2ba7fbfd71

    • SHA1

      a3745731e1bdae7a22d623633b4c638f74e2b8a8

    • SHA256

      aa2cae824c23fc15f2ef9fd64e369a78d49f1a068737a01c7697bae442971410

    • SHA512

      689ba73d0d19fb559ba00b0690673071f9a16c976c0db0a70e977ea6c10db852d6f1d594fc7b8b49c3fabbddf49021f425f2c9dc9387f5dd1791f4dba1f9314a

    • SSDEEP

      24576:987Ezl5WChST3zxyDR0KUewtUQ398MmYSWD/58zLEeJthK2r/xYEisxMr4/6zLiU:G4l5WChSTfKUeaFyhthD/Lj5

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • A potential corporate email address has been identified in the URL: prebid-universal-creative@latest

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks