Overview

overview

10

Static

static

7

3898534fa6...d4.exe

windows7-x64

7

3898534fa6...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7f6eb480fe715733e509d0489171c18.bin

  • Size

    1.0MB

  • Sample

    240708-evd67atgph

  • MD5

    3634cbfa2e5f12b1d2af625a16175c5a

  • SHA1

    ef03ba76f33e3aa7cd7654b81e90fba0ac113630

  • SHA256

    06b0a54387089837ec942b7b26d9b6e6644e793ec8ee1600674951b3e9e8ce64

  • SHA512

    ab1be6981062627ed37138a19a27c66e38155e3d8c3ce1c63827562463af5cc55612881e0093f628d2e1f8dfa44e6124dc9df5a928db8f8712fdbbd67fc43f1f

  • SSDEEP

    24576:WCIA+DRvBy73xUjLbH+pjtbWZ0ClWR9zg8UHNZ0hwQ7TM5KMgKg:W9nbywH4jIZyR9z0tZxQ7TM5KMgKg

Score
10/10
raccoon23b7de51bb42a569733f1e26dbce63bastealerupx

Malware Config

Extracted

Family

raccoon

Botnet

23b7de51bb42a569733f1e26dbce63ba

C2

http://95.169.205.186:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe

    • Size

      1.0MB

    • MD5

      f7f6eb480fe715733e509d0489171c18

    • SHA1

      e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48

    • SHA256

      3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4

    • SHA512

      962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988

    • SSDEEP

      24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+

    Score
    10/10
    upxraccoon23b7de51bb42a569733f1e26dbce63bastealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks