raccoon

General

Target

554fc65693d78f2426307ace6a43a77c
Size

195KB
Sample

210720-ckmcqm2p92
MD5

554fc65693d78f2426307ace6a43a77c
SHA1

fade98f06c67085f031b3c38b0717348b37c6da0
SHA256

9f8bc9f4bf9a07d5f14fe30f18a5423be70b6f7c791d42c7e8d2257d2e1bd397
SHA512

21963ebb7788711f2fb9043db0f32cf98f4a4523403a36e775b5b455667f2b002f8de9f25e8ff1aaf14f323424115d8a4ec394302bc2ce328ee499ba9803278a

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Extracted

Family

redline

C2

woltelorda.xyz:80

Extracted

Family

redline

Botnet

80bza1k

C2

135.148.139.222:33569

Extracted

Family

redline

Botnet

testSind

C2

135.148.139.222:33569

Extracted

Family

vidar

Version

39.7

Botnet

824

C2

https://shpak125.tumblr.com/

Attributes

profile_id
824

Targets

- Target
  
  554fc65693d78f2426307ace6a43a77c
- Size
  
  195KB
- MD5
  
  554fc65693d78f2426307ace6a43a77c
- SHA1
  
  fade98f06c67085f031b3c38b0717348b37c6da0
- SHA256
  
  9f8bc9f4bf9a07d5f14fe30f18a5423be70b6f7c791d42c7e8d2257d2e1bd397
- SHA512
  
  21963ebb7788711f2fb9043db0f32cf98f4a4523403a36e775b5b455667f2b002f8de9f25e8ff1aaf14f323424115d8a4ec394302bc2ce328ee499ba9803278a
Score

10^/10

raccoon redline smokeloader 80bza1k testsind backdoor discovery evasion infostealer spyware stealer themida trojan vidar 824
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2