General

  • Target

    5665901095a6d28a314adbab200b6955.exe

  • Size

    30.5MB

  • Sample

    250209-ax12hsyra1

  • MD5

    5665901095a6d28a314adbab200b6955

  • SHA1

    99e64d0c868b5a496ae2b32b726dbc1355127e3d

  • SHA256

    da2a3a3d58af1127efe6f5132182f75d7b91643ca5e1890db33d2f0384e57362

  • SHA512

    8476dca0bd990b31dbf65a22c29387ed59baca93cbae7c4527b64cb266ef56a207cd1e5439feab52ca55c0f7d7274414ad79ac99d2b37b0d9f9eec3dada105c4

  • SSDEEP

    393216:1FLLFvuBRlnqFgPqNJxz/2oq/HQnTRTboty:15JolnxezeoZh

Malware Config

Extracted

Family

raccoon

Botnet

1adeb438cd8ab2abb4349e0ca6853b53

C2

http://94.142.138.234

http://94.142.138.235

Attributes
  • user_agent

    B1D3N_RIM_MY_ASS

xor.plain

Targets

    • Target

      5665901095a6d28a314adbab200b6955.exe

    • Size

      30.5MB

    • MD5

      5665901095a6d28a314adbab200b6955

    • SHA1

      99e64d0c868b5a496ae2b32b726dbc1355127e3d

    • SHA256

      da2a3a3d58af1127efe6f5132182f75d7b91643ca5e1890db33d2f0384e57362

    • SHA512

      8476dca0bd990b31dbf65a22c29387ed59baca93cbae7c4527b64cb266ef56a207cd1e5439feab52ca55c0f7d7274414ad79ac99d2b37b0d9f9eec3dada105c4

    • SSDEEP

      393216:1FLLFvuBRlnqFgPqNJxz/2oq/HQnTRTboty:15JolnxezeoZh

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Downloads MZ/PE file

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks