Overview

overview

10

Static

static

7

3898534fa6...d4.exe

windows7-x64

7

3898534fa6...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe

  • Size

    1.0MB

  • Sample

    240707-bf5h2s1gqc

  • MD5

    f7f6eb480fe715733e509d0489171c18

  • SHA1

    e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48

  • SHA256

    3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

  • SHA512

    962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988

  • SSDEEP

    24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

Score
10/10
raccoon23b7de51bb42a569733f1e26dbce63bastealerupx

Malware Config

Extracted

Family

raccoon

Botnet

23b7de51bb42a569733f1e26dbce63ba

C2

http://95.169.205.186:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe

    • Size

      1.0MB

    • MD5

      f7f6eb480fe715733e509d0489171c18

    • SHA1

      e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48

    • SHA256

      3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

    • SHA512

      962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988

    • SSDEEP

      24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

    Score
    10/10
    upxraccoon23b7de51bb42a569733f1e26dbce63bastealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks