raccoon

General

Target

ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
Size

523KB
Sample

211019-vwcbzsgca7
MD5

329acf4d6a5e735c1fd3b3fc6c77d3f3
SHA1

932598a6dbd5eaa0bd7b2aabd16f9c5fab62d960
SHA256

ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
SHA512

1c4b78f03238bd6e01abd14794c78ab5a27daf32c6a7237e814740f81c5892f4353f1145c71ad4fd1c57f5675a2281645de3fa437d78c05d5cc24c02f41cf4b5

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

a06a98982bae8443ba3531b93da56215a757d3d5

Attributes

url4cnc
http://telegatt.top/oushthenextg
http://telegka.top/oushthenextg
http://telegin.top/oushthenextg
https://t.me/oushthenextg

rc4.plain

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes

profile_id
937

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

rc4.i32

Targets

- Target
  
  ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
- Size
  
  523KB
- MD5
  
  329acf4d6a5e735c1fd3b3fc6c77d3f3
- SHA1
  
  932598a6dbd5eaa0bd7b2aabd16f9c5fab62d960
- SHA256
  
  ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
- SHA512
  
  1c4b78f03238bd6e01abd14794c78ab5a27daf32c6a7237e814740f81c5892f4353f1145c71ad4fd1c57f5675a2281645de3fa437d78c05d5cc24c02f41cf4b5
Score

10^/10

evasion spyware stealer trojan raccoon redline smokeloader vidar 937 a06a98982bae8443ba3531b93da56215a757d3d5 backdoor infostealer themida
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2