Overview

overview

10

Static

static

8705c5d7e6...24.exe

windows7_x64

10

8705c5d7e6...24.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8705c5d7e60a14a519f662913494d624.exe
  • Size 219KB
  • Sample211116-e5dneaccg2
  • SHA256 a6c90b4cf3dac72a1cf401cd8995b5e8a7e11b38efb76ba1c06af7867683d76d
  • MD5 SHA1 SHA512
Score
10/10
raccoonsmokeloader4fc7b281a211dd243b4b1e5cb64d3f854a218b97backdoorstealertrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://membro.at/upload/

  • http://jeevanpunetha.com/upload/

  • http://misipu.cn/upload/

  • http://zavodooo.ru/upload/

  • http://targiko.ru/upload/

  • http://vues3d.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • 4fc7b281a211dd243b4b1e5cb64d3f854a218b97

Attributes
  • url4cnc

    http://91.219.236.162/youyouhell0world

    http://185.163.47.176/youyouhell0world

    http://193.38.54.238/youyouhell0world

    http://74.119.192.122/youyouhell0world

    http://91.219.236.240/youyouhell0world

    https://t.me/youyouhell0world

rc4.plain
rc4.plain

Targets

    • Target
      8705c5d7e60a14a519f662913494d624.exe
    • Size 219KB
    • SHA256 a6c90b4cf3dac72a1cf401cd8995b5e8a7e11b38efb76ba1c06af7867683d76d
    • MD5 SHA1 SHA512
    Score
    10/10
    smokeloaderbackdoortrojanraccoon4fc7b281a211dd243b4b1e5cb64d3f854a218b97stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks