raccoon

General

Target

da82741efad64eea568ae23f173cfbd7.exe
Size

2.4MB
Sample

210223-qtntarbwg2
MD5

da82741efad64eea568ae23f173cfbd7
SHA1

08769c6a627e2b7562e8226de7f0caf4cbf4b454
SHA256

8a323a769306f2473a63de314724e0953087224919e723b88adcc94ff7a9e3a6
SHA512

5ee93ca8e92c57c97afd63aec7fcaf020d02f494f69cdf76d3b706f10bf8a5b8d710da20e5ccb5c128252b6fed854c101cc24adfc0c7c8632facc5605cd0cb33

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

aef61793e586ca15c24106ac17a2a83a30fb0a25

Attributes

url4cnc
https://tttttt.me/h_scroogenews_1

rc4.plain

Extracted

Family

raccoon

Botnet

99fdcb30af520f176f0e14e858c8bb23c13330d9

Attributes

url4cnc
https://tttttt.me/jrrand0mer

rc4.plain

Targets

- Target
  
  da82741efad64eea568ae23f173cfbd7.exe
- Size
  
  2.4MB
- MD5
  
  da82741efad64eea568ae23f173cfbd7
- SHA1
  
  08769c6a627e2b7562e8226de7f0caf4cbf4b454
- SHA256
  
  8a323a769306f2473a63de314724e0953087224919e723b88adcc94ff7a9e3a6
- SHA512
  
  5ee93ca8e92c57c97afd63aec7fcaf020d02f494f69cdf76d3b706f10bf8a5b8d710da20e5ccb5c128252b6fed854c101cc24adfc0c7c8632facc5605cd0cb33
Score

10^/10

raccoon redline xmrig 99fdcb30af520f176f0e14e858c8bb23c13330d9 aef61793e586ca15c24106ac17a2a83a30fb0a25 evasion infostealer miner spyware stealer themida trojan discovery
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detected Stratum cryptominer command
  Looks to be attempting to contact Stratum mining pool.
  miner
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner Payload
  miner
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- themida
  Detects Themida, Advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2