raccoon

Sharing

General

Target

d3546ba4a1fefb0a7f478e9af1493bec.exe
Size

260KB
Sample

211004-tnhy5aggbq
MD5

d3546ba4a1fefb0a7f478e9af1493bec
SHA1

ba5ec1494db7421467205d5a171878153639c701
SHA256

90a2edd5280d702618114ba0a6822edbd249f3e3b02bcf31d977fca3d958582d
SHA512

8b909d21f086de59c4f833a6d335c9077071c616ff094dbbce0dbfe771caf4210d272600b42181ba5fdeea67f95d39be8f4ab5519b23428ccb118ee3d67262f1

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

rc4.i32

Extracted

Family

redline

Botnet

Proliv

93.115.20.139:28978

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

Huntington Bank

34.94.44.44:45181

Extracted

Family

redline

Botnet

@big_tastyyy

87.251.71.44:80

Extracted

Family

raccoon

Botnet

61491ed5436f034714f70beac9b11914bfa969d2

Attributes

url4cnc
https://t.me/hdmiprapor

rc4.plain

Targets

- Target
  
  d3546ba4a1fefb0a7f478e9af1493bec.exe
- Size
  
  260KB
- MD5
  
  d3546ba4a1fefb0a7f478e9af1493bec
- SHA1
  
  ba5ec1494db7421467205d5a171878153639c701
- SHA256
  
  90a2edd5280d702618114ba0a6822edbd249f3e3b02bcf31d977fca3d958582d
- SHA512
  
  8b909d21f086de59c4f833a6d335c9077071c616ff094dbbce0dbfe771caf4210d272600b42181ba5fdeea67f95d39be8f4ab5519b23428ccb118ee3d67262f1
Score

10^/10

raccoon redline smokeloader tofsee 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 @big_tastyyy huntington bank proliv backdoor evasion infostealer persistence stealer themida trojan 61491ed5436f034714f70beac9b11914bfa969d2 discovery spyware suricata
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
  suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
  suricata
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
  suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Privilege Escalation

New Service

T1050

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

RedLine

RedLine Payload

SmokeLoader

Tofsee

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2