raccoon

General

Target

Setup.exe
Size

523KB
Sample

211020-v4vtashdd3
MD5

329acf4d6a5e735c1fd3b3fc6c77d3f3
SHA1

932598a6dbd5eaa0bd7b2aabd16f9c5fab62d960
SHA256

ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
SHA512

1c4b78f03238bd6e01abd14794c78ab5a27daf32c6a7237e814740f81c5892f4353f1145c71ad4fd1c57f5675a2281645de3fa437d78c05d5cc24c02f41cf4b5

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes

profile_id
937

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes

url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar

rc4.plain

Extracted

Family

vidar

Version

41.5

Botnet

1028

C2

https://mas.to/@xeroxxx

Attributes

profile_id
1028

Extracted

Family

redline

C2

205.185.119.191:60857

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

rc4.i32

Targets

- Target
  
  Setup.exe
- Size
  
  523KB
- MD5
  
  329acf4d6a5e735c1fd3b3fc6c77d3f3
- SHA1
  
  932598a6dbd5eaa0bd7b2aabd16f9c5fab62d960
- SHA256
  
  ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
- SHA512
  
  1c4b78f03238bd6e01abd14794c78ab5a27daf32c6a7237e814740f81c5892f4353f1145c71ad4fd1c57f5675a2281645de3fa437d78c05d5cc24c02f41cf4b5
Score

10^/10

evasion spyware stealer trojan raccoon redline smokeloader tofsee vidar 1028 7c9b4504a63ed23664e38808e65948379b790395 937 backdoor infostealer persistence themida upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2