Overview

overview

10

Static

static

6177d85be5...b1.exe

windows7_x64

10

6177d85be5...b1.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6177d85be52132376166b865ebca55b1.exe
  • Size 164KB
  • Sample211116-ehc4csccb5
  • SHA256 f6c10cababdca8d6de20f8977489182b31ce24bb2ac9399965d32cedf0f526fe
  • MD5 SHA1 SHA512
Score
10/10
raccoonsmokeloader4fc7b281a211dd243b4b1e5cb64d3f854a218b97backdoorstealertrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://membro.at/upload/

  • http://jeevanpunetha.com/upload/

  • http://misipu.cn/upload/

  • http://zavodooo.ru/upload/

  • http://targiko.ru/upload/

  • http://vues3d.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • 4fc7b281a211dd243b4b1e5cb64d3f854a218b97

Attributes
  • url4cnc

    http://91.219.236.162/youyouhell0world

    http://185.163.47.176/youyouhell0world

    http://193.38.54.238/youyouhell0world

    http://74.119.192.122/youyouhell0world

    http://91.219.236.240/youyouhell0world

    https://t.me/youyouhell0world

rc4.plain
rc4.plain

Targets

    • Target
      6177d85be52132376166b865ebca55b1.exe
    • Size 164KB
    • SHA256 f6c10cababdca8d6de20f8977489182b31ce24bb2ac9399965d32cedf0f526fe
    • MD5 SHA1 SHA512
    Score
    10/10
    smokeloaderbackdoortrojanraccoon4fc7b281a211dd243b4b1e5cb64d3f854a218b97stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks