General
-
Target
57419fbf613f876b7dd2e4affac2b73aab88cdd3f607219a3f6727a6981d848a
-
Size
313KB
-
Sample
210810-dkpsac4qpj
-
MD5
03c43d2d00d7cfb1bc1361906bb19540
-
SHA1
3441f91086602ede245d4748f5cd581af4bca08d
-
SHA256
57419fbf613f876b7dd2e4affac2b73aab88cdd3f607219a3f6727a6981d848a
-
SHA512
6971cafd4daf89c437aab338b4e871f738531f2bc14ef3800e4b4e3a3c83edb5591ab47667610975b8f7d516efd5d9a10df6de8912f4d2694f8a2d6cbe07767e
Static task
static1
Behavioral task
behavioral1
Sample
57419fbf613f876b7dd2e4affac2b73aab88cdd3f607219a3f6727a6981d848a.exe
Resource
win10v20210410
Malware Config
Extracted
http://91.241.19.52/Api/GetFile2
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
raccoon
83fbe81dd43f775dd8af3cd619f88f428fbd9a96
-
url4cnc
https://telete.in/opa4kiprivatem
Targets
-
-
Target
57419fbf613f876b7dd2e4affac2b73aab88cdd3f607219a3f6727a6981d848a
-
Size
313KB
-
MD5
03c43d2d00d7cfb1bc1361906bb19540
-
SHA1
3441f91086602ede245d4748f5cd581af4bca08d
-
SHA256
57419fbf613f876b7dd2e4affac2b73aab88cdd3f607219a3f6727a6981d848a
-
SHA512
6971cafd4daf89c437aab338b4e871f738531f2bc14ef3800e4b4e3a3c83edb5591ab47667610975b8f7d516efd5d9a10df6de8912f4d2694f8a2d6cbe07767e
-
Raccoon Stealer Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-