Overview

overview

10

Static

static

5ceb8ab578...c1.exe

windows7_x64

10

5ceb8ab578...c1.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5ceb8ab578f3be9d15e01c08a46c31c1.exe
  • Size 320KB
  • Sample211027-ny1n2aefc2
  • SHA256 a6b6db3fc549c6648a2959d43cddbf790f2a3b64e380d6919ed6231c19641f46
  • MD5 SHA1 SHA512
Score
10/10
raccoonsmokeloader9dc771dc7e85f59c03cb7b7e8b3457b079a2d538backdoorstealertrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://brandyjaggers.com/upload/

  • http://andbal.com/upload/

  • http://alotofquotes.com/upload/

  • http://szpnc.cn/upload/

  • http://uggeboots.com/upload/

  • http://100klv.com/upload/

  • http://rapmusic.at/upload/

rc4.i32
rc4.i32

Extracted

Family

  • raccoon

Botnet

  • 9dc771dc7e85f59c03cb7b7e8b3457b079a2d538

Attributes
  • url4cnc

    http://telegin.top/opussenseus1

    http://ttmirror.top/opussenseus1

    http://teletele.top/opussenseus1

    http://telegalive.top/opussenseus1

    http://toptelete.top/opussenseus1

    http://telegraf.top/opussenseus1

    https://t.me/opussenseus1

rc4.plain
rc4.plain

Targets

    • Target
      5ceb8ab578f3be9d15e01c08a46c31c1.exe
    • Size 320KB
    • SHA256 a6b6db3fc549c6648a2959d43cddbf790f2a3b64e380d6919ed6231c19641f46
    • MD5 SHA1 SHA512
    Score
    10/10
    raccoonsmokeloader9dc771dc7e85f59c03cb7b7e8b3457b079a2d538backdoorstealertrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks