raccoon

General

Target

C7DF63BD3D9DBD3CBD11E02D0CA6F8988251BF5BEA12D.exe
Size

2.6MB
Sample

211002-ab462sdcc8
MD5

a1a2a0b423349f463d23969864a111c0
SHA1

37d83a34da50b959759cbb18b01654bbd17bbb3f
SHA256

c7df63bd3d9dbd3cbd11e02d0ca6f8988251bf5bea12d6d76c40ba2d33b5468d
SHA512

3100ef7b7cb3c5887bbf6a8eededee660da6f0744e09943bc1276b9db09baaed7dab299a09ace9ba64c09a17d5a47126b8edd9e21be96d78b2bcd9a434940d2d

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

39.7

Botnet

933

C2

https://shpak125.tumblr.com/

Attributes

profile_id
933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

rc4.i32

Extracted

Family

raccoon

Botnet

� um@�Y]��sN)R��B��Jbd~7�4�e�9�{�

Attributes

url4cnc
�cb{K^�WXP�۸��fB:O�ѡԾ"e.�p�tI�'�.��kAd(8��(�G�� a�@�R��jN�V��N*��

rc4.plain

Extracted

Family

vidar

Version

41.1

Botnet

937

C2

https://mas.to/@bardak1ho

Attributes

profile_id
937

Extracted

Family

raccoon

Botnet

�! =A�B_��!Os�ܺ��?0yd�f�0F�:�-�

Attributes

url4cnc
�cb{K^�WXP�۸��fB:O�ȼ��/1h �m�p_�|�;�\�~ |"v��h�[��i�a��1S��>��Ѩ�R�P2��@cC

rc4.plain

Targets

- Target
  
  C7DF63BD3D9DBD3CBD11E02D0CA6F8988251BF5BEA12D.exe
- Size
  
  2.6MB
- MD5
  
  a1a2a0b423349f463d23969864a111c0
- SHA1
  
  37d83a34da50b959759cbb18b01654bbd17bbb3f
- SHA256
  
  c7df63bd3d9dbd3cbd11e02d0ca6f8988251bf5bea12d6d76c40ba2d33b5468d
- SHA512
  
  3100ef7b7cb3c5887bbf6a8eededee660da6f0744e09943bc1276b9db09baaed7dab299a09ace9ba64c09a17d5a47126b8edd9e21be96d78b2bcd9a434940d2d
Score

10^/10

raccoon smokeloader vidar 933 � um@�y]��sn)r��b��jbd~7�4�e�9�{�aspackv2 backdoor discovery evasion spyware stealer trojan 937 �! =a�b_��!os�ܺ��?0yd�f�0f�:�-�themida
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Nirsoft
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2