raccoon

General

Target

A5F4EB3B915BCFDD72CB81B7D89C0C0FD6B190B637DB6.exe
Size

4.5MB
Sample

210817-m1z82f8dxa
MD5

2d3e5a2a2243d788901fb182156f4031
SHA1

acf66cababaeba6d72e72d2962405f41052d79a0
SHA256

a5f4eb3b915bcfdd72cb81b7d89c0c0fd6b190b637db6ffad25604d24985f9e8
SHA512

74287eab6153bb074dc6b5c2f25624b70a4bda2eb54a1071a37a4adf0781646b7ecdccfc86e794ce1d6ceeb75b070f0e8ea78c9642fa67147f3c806f03245888

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

DomAni

C2

ergerr3.top:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Extracted

Family

raccoon

Botnet

171b0ea0beebb33c2d9043b095edfe8ec188b323

Attributes

url4cnc
https://telete.in/fihborntoflyes

rc4.plain

Targets

- Target
  
  A5F4EB3B915BCFDD72CB81B7D89C0C0FD6B190B637DB6.exe
- Size
  
  4.5MB
- MD5
  
  2d3e5a2a2243d788901fb182156f4031
- SHA1
  
  acf66cababaeba6d72e72d2962405f41052d79a0
- SHA256
  
  a5f4eb3b915bcfdd72cb81b7d89c0c0fd6b190b637db6ffad25604d24985f9e8
- SHA512
  
  74287eab6153bb074dc6b5c2f25624b70a4bda2eb54a1071a37a4adf0781646b7ecdccfc86e794ce1d6ceeb75b070f0e8ea78c9642fa67147f3c806f03245888
Score

10^/10

redline smokeloader vidar 706 domani aspackv2 backdoor evasion infostealer persistence stealer suricata themida trojan raccoon 171b0ea0beebb33c2d9043b095edfe8ec188b323 upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Raccoon Stealer Payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
  suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2