raccoon

Sharing

General

Target

a5e7ab79fcf5c7e04ee7afb6671c9583.exe
Size

178KB
Sample

211030-nq5ysaehc8
MD5

a5e7ab79fcf5c7e04ee7afb6671c9583
SHA1

7a5f6e51d1588b28cebf121d1424efbecbf5185c
SHA256

2ec690879452f894a54c3f8350e0a935ff5b95c592dd41c61c073fd1ddc0521c
SHA512

b4e42b528f0a48b70e1f8775c7ad01b254bc67a98e5e28472e84da20793138746e0cb36e569e86fc742fa4dd43ace1968b33e84b946ba6694cbd5e2ec2db7b56

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

http://honawey70.top/

http://wijibui00.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

http://193.56.146.214/

https://193.56.146.214/

rc4.i32

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

redline

Botnet

999888988

93.115.20.139:28978

Extracted

Family

raccoon

Botnet

eae58d570cc74796157b14c575bd3adc01116ca0

Attributes

url4cnc
http://telegka.top/rino115sipsip
http://telegin.top/rino115sipsip
https://t.me/rino115sipsip

rc4.plain

Extracted

Family

raccoon

Botnet

6e0c0520224e4bf749c8798329dceea779d7d7b2

Attributes

url4cnc
http://telegatt.top/hdmiprapor
http://telegka.top/hdmiprapor
http://telegin.top/hdmiprapor
https://t.me/hdmiprapor

rc4.plain

Targets

- Target
  
  a5e7ab79fcf5c7e04ee7afb6671c9583.exe
- Size
  
  178KB
- MD5
  
  a5e7ab79fcf5c7e04ee7afb6671c9583
- SHA1
  
  7a5f6e51d1588b28cebf121d1424efbecbf5185c
- SHA256
  
  2ec690879452f894a54c3f8350e0a935ff5b95c592dd41c61c073fd1ddc0521c
- SHA512
  
  b4e42b528f0a48b70e1f8775c7ad01b254bc67a98e5e28472e84da20793138746e0cb36e569e86fc742fa4dd43ace1968b33e84b946ba6694cbd5e2ec2db7b56
Score

10^/10

raccoon redline smokeloader 68e2d75238f7c69859792d206401b6bde2b2515c 999888988 eae58d570cc74796157b14c575bd3adc01116ca0 superstar backdoor discovery evasion infostealer spyware stealer themida trojan vmprotect 6e0c0520224e4bf749c8798329dceea779d7d7b2
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Themida packer

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2