raccoon

General

Target

34e36e640492423d55b80bd5ac3ddb77b6b9e87c.exe
Size

631KB
Sample

211003-3pesjafff6
MD5

94f06bfbb349287c89ccc92ac575123f
SHA1

34e36e640492423d55b80bd5ac3ddb77b6b9e87c
SHA256

d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc
SHA512

c8a5362f9a35737ac04b6e0c48371aa60e64adf1157e16191691ac4dccb8dbaac261b516ebb89fc84ba741616ea1ca888a4a180ef2cf89ca04ebdc7768ea0fbb

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.1

Botnet

937

C2

https://mas.to/@bardak1ho

Attributes

profile_id
937

Extracted

Family

smokeloader

Version

2020

C2

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32

Extracted

Family

raccoon

Botnet

�u"jHI�G �˴��syP��@��Nk6"a�b�g�=�(�

Attributes

url4cnc
�cb{K^�WXP�۸��fB:O�ѯDɭ:0s&�4�l�x�d��f d&Hc��.��L��m�|�_V� ��j�V��L:鴚�٧�^�Ig

rc4.plain

Extracted

Family

redline

C2

195.2.93.217:59309

Targets

- Target
  
  34e36e640492423d55b80bd5ac3ddb77b6b9e87c.exe
- Size
  
  631KB
- MD5
  
  94f06bfbb349287c89ccc92ac575123f
- SHA1
  
  34e36e640492423d55b80bd5ac3ddb77b6b9e87c
- SHA256
  
  d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc
- SHA512
  
  c8a5362f9a35737ac04b6e0c48371aa60e64adf1157e16191691ac4dccb8dbaac261b516ebb89fc84ba741616ea1ca888a4a180ef2cf89ca04ebdc7768ea0fbb
Score

10^/10

raccoon redline smokeloader socelars vidar 937 �u"jhi�g �˴��syp��@��nk6"a�b�g�=�(�agilenet backdoor evasion infostealer spyware stealer themida trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2