raccoon

Resubmissions

15-09-2021 19:17

210915-xzrxysebhk 10

15-09-2021 18:49

210915-xge6faebfn 10

Sharing

Copy URL

Twitter E-mail

General

Target

03d329f251ed2b183419450cf9b427fe366a0a1529956715405823fddb8c6b06
Size

164KB
Sample

210915-xzrxysebhk
MD5

26ea74078c97a6e5e3530d8e514e5fa3
SHA1

c2b002ad430c522f04b9a435fa4ba0bda944aaef
SHA256

03d329f251ed2b183419450cf9b427fe366a0a1529956715405823fddb8c6b06
SHA512

31adf2574f2db5dae8b25db9857af71a586d7e2044d1d886da5e456501883d513ddc1e8dcf34e48447acd4effc985df637e5ec0bb142aba3b38faf796d98ccd8

Malware Config

Extracted

Family

smokeloader

Version

2020

http://fazanaharahe1.xyz/

http://xandelissane2.xyz/

http://ustiassosale3.xyz/

http://cytheriata4.xyz/

http://ggiergionard5.xyz/

http://rrelleynaniy6.store/

http://danniemusoa7.store/

http://nastanizab8.store/

http://onyokandis9.store/

http://dmunaavank10.store/

http://gilmandros11.site/

http://cusanthana12.site/

http://willietjeana13.site/

http://ximusokall14.site/

http://blodinetisha15.site/

http://urydiahadyss16.club/

http://glasamaddama17.club/

http://marlingarly18.club/

http://alluvianna19.club/

http://xandirkaniel20.club/

rc4.i32

Extracted

Family

raccoon

Botnet

e89524de1a131be43c3cc9ec324dabb6a9998c12

Attributes

url4cnc
https://telete.in/httpnotdetect1

rc4.plain

Extracted

Family

redline

Botnet

Mix 1592021

93.115.20.139:28978

Extracted

Family

redline

Botnet

94.26.248.150:17618

Extracted

Family

redline

Botnet

win10

95.37.95.152:64263

Extracted

Family

vidar

Version

40.6

Botnet

936

https://dimonbk83.tumblr.com/

Attributes

profile_id
936

Targets

- Target
  
  03d329f251ed2b183419450cf9b427fe366a0a1529956715405823fddb8c6b06
- Size
  
  164KB
- MD5
  
  26ea74078c97a6e5e3530d8e514e5fa3
- SHA1
  
  c2b002ad430c522f04b9a435fa4ba0bda944aaef
- SHA256
  
  03d329f251ed2b183419450cf9b427fe366a0a1529956715405823fddb8c6b06
- SHA512
  
  31adf2574f2db5dae8b25db9857af71a586d7e2044d1d886da5e456501883d513ddc1e8dcf34e48447acd4effc985df637e5ec0bb142aba3b38faf796d98ccd8
Score

10^/10

raccoon redline smokeloader tofsee xmrig 33 e89524de1a131be43c3cc9ec324dabb6a9998c12 mix 1592021 win10 backdoor discovery evasion infostealer miner persistence spyware stealer suricata themida trojan agilenet vidar 936
- Modifies system executable filetype association
  persistence
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Registers COM server for autorun
  persistence
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- evasion
  evasion.
  evasion
- suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)
  suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)
  suricata
- suricata: ET MALWARE Generic gate[.].php GET with minimal headers
  suricata: ET MALWARE Generic gate[.].php GET with minimal headers
  suricata
- suricata: ET MALWARE Known Sinkhole Response Header
  suricata: ET MALWARE Known Sinkhole Response Header
  suricata
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
  suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
  suricata
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Zeus Bot Connectivity Check
  suricata: ET MALWARE Zeus Bot Connectivity Check
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- XMRig Miner Payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

New Service

T1050

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Modifies system executable filetype association

RedLine

RedLine Payload

Registers COM server for autorun

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Vidar

Windows security bypass

evasion

suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

suricata: ET MALWARE Generic gate[.].php GET with minimal headers

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Zeus Bot Connectivity Check

xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar Stealer

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7