General
-
Target
748db83df05e31c80a5e71e6eb4d58567877d5045e574a766ce947c2e6709289
-
Size
196KB
-
Sample
211110-w1r4nsaaa7
-
MD5
220e71fb2561a371f2bf5c0cdd16811b
-
SHA1
6dc793481ae0624da06a47e2e6f9562e1154aabf
-
SHA256
748db83df05e31c80a5e71e6eb4d58567877d5045e574a766ce947c2e6709289
-
SHA512
c1ea6b5cd9759f45d87523fe7577cd72033aac36477da59cb5b60b4af35b88c8f8db0c0ac6fe33227fcb857be1b7ac7962af8cdcf86c02b966ab890cf3c50d4b
Malware Config
Extracted
smokeloader
2020
http://misha.at/upload/
http://roohaniinfra.com/upload/
http://0axqpcc.cn/upload/
http://mayak-lombard.ru/upload/
http://mebel-lass.ru/upload/
http://dishakhan.com/upload/
Extracted
raccoon
1.8.3-hotfix
fcdc156d3872c18d25e3ee45499599b45e492a67
-
url4cnc
http://178.23.190.57/rino115sipsip
http://91.219.236.162/rino115sipsip
http://185.163.47.176/rino115sipsip
http://193.38.54.238/rino115sipsip
http://74.119.192.122/rino115sipsip
http://91.219.236.240/rino115sipsip
https://t.me/rino115sipsip
Extracted
raccoon
1.8.3-hotfix
4fc7b281a211dd243b4b1e5cb64d3f854a218b97
-
url4cnc
http://91.219.236.162/youyouhell0world
http://185.163.47.176/youyouhell0world
http://193.38.54.238/youyouhell0world
http://74.119.192.122/youyouhell0world
http://91.219.236.240/youyouhell0world
https://t.me/youyouhell0world
Targets
-
-
Target
748db83df05e31c80a5e71e6eb4d58567877d5045e574a766ce947c2e6709289
-
Size
196KB
-
MD5
220e71fb2561a371f2bf5c0cdd16811b
-
SHA1
6dc793481ae0624da06a47e2e6f9562e1154aabf
-
SHA256
748db83df05e31c80a5e71e6eb4d58567877d5045e574a766ce947c2e6709289
-
SHA512
c1ea6b5cd9759f45d87523fe7577cd72033aac36477da59cb5b60b4af35b88c8f8db0c0ac6fe33227fcb857be1b7ac7962af8cdcf86c02b966ab890cf3c50d4b
Score10/10-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Drops startup file
-