Overview

overview

10

Static

static

f52402eda8...5c.exe

windows7_x64

10

f52402eda8...5c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f52402eda80d1ee27ace606b85351e5c.exe
  • Size 149KB
  • Sample211116-g7rn6ahfbk
  • SHA256 ca66ff7c6e083cb26d29df9aba7b00af2d7263a8bebf71bd89077914588eebdb
  • MD5 SHA1 SHA512
Score
10/10
raccoonsmokeloader4fc7b281a211dd243b4b1e5cb64d3f854a218b97backdoorstealertrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://membro.at/upload/

  • http://jeevanpunetha.com/upload/

  • http://misipu.cn/upload/

  • http://zavodooo.ru/upload/

  • http://targiko.ru/upload/

  • http://vues3d.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • 4fc7b281a211dd243b4b1e5cb64d3f854a218b97

Attributes
  • url4cnc

    http://91.219.236.162/youyouhell0world

    http://185.163.47.176/youyouhell0world

    http://193.38.54.238/youyouhell0world

    http://74.119.192.122/youyouhell0world

    http://91.219.236.240/youyouhell0world

    https://t.me/youyouhell0world

rc4.plain
rc4.plain

Targets

    • Target
      f52402eda80d1ee27ace606b85351e5c.exe
    • Size 149KB
    • SHA256 ca66ff7c6e083cb26d29df9aba7b00af2d7263a8bebf71bd89077914588eebdb
    • MD5 SHA1 SHA512
    Score
    10/10
    smokeloaderbackdoortrojanraccoon4fc7b281a211dd243b4b1e5cb64d3f854a218b97stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks