raccoon

General

Target

d9da332f244b8783ab7ea18da3ed82a37341afafeb9bab900931b349bfe044b9
Size

286KB
Sample

210927-22c9ssaca7
MD5

0f7a5240c5ad0cb0ea8bbcb69d313ffb
SHA1

657c89b24d14b2eb6b96502b7b784d46a361a8c8
SHA256

d9da332f244b8783ab7ea18da3ed82a37341afafeb9bab900931b349bfe044b9
SHA512

0218e802e1703e9d9d78456cd19e96a9123837bf37872472041c8acbe73db40ba6671703c6401392a84d7bde953d35db1141d72adb6c6b24dd229b3b5bdf86ec

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

raketa

C2

45.144.29.94:61419

Extracted

Family

redline

Botnet

Denis

C2

45.147.197.123:31820

Extracted

Family

redline

Botnet

MIX

C2

giceriefar.xyz:80

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Targets

- Target
  
  d9da332f244b8783ab7ea18da3ed82a37341afafeb9bab900931b349bfe044b9
- Size
  
  286KB
- MD5
  
  0f7a5240c5ad0cb0ea8bbcb69d313ffb
- SHA1
  
  657c89b24d14b2eb6b96502b7b784d46a361a8c8
- SHA256
  
  d9da332f244b8783ab7ea18da3ed82a37341afafeb9bab900931b349bfe044b9
- SHA512
  
  0218e802e1703e9d9d78456cd19e96a9123837bf37872472041c8acbe73db40ba6671703c6401392a84d7bde953d35db1141d72adb6c6b24dd229b3b5bdf86ec
Score

10^/10

raccoon redline smokeloader 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 denis mix raketa backdoor discovery infostealer spyware stealer trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1