raccoon | 03cc67fc770fead507e30c951cab5e55c897b78f7ec39b37d3569ebef8f6df3e | Triage

Sharing

General

Target

03cc67fc770fead507e30c951cab5e55c897b78f7ec39b37d3569ebef8f6df3e
Size

140KB
Sample

211117-td759sdcc7
MD5

0c23fac57bfe5c066a2ad7054d7b20f2
SHA1

d6499456caf9837ce65a7ddc00064fb48cb88de3
SHA256

03cc67fc770fead507e30c951cab5e55c897b78f7ec39b37d3569ebef8f6df3e
SHA512

2b2e070a3ef241ee6aeb2c4f3a2ddeb262c51b9124448846f3461c9ac966ca23ca43890d030ef554ef688129e7e87f019fee7a9284d4d879e9aec87babae5fd6

Score

10^/10

raccoon redline smokeloader ddf183af4241e3172885cf1b2c4c1fb4ee03d05a e0a5b6f1f905520b5671c84d59bd182b3eb344c6 backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes

url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar

rc4.plain

rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

e0a5b6f1f905520b5671c84d59bd182b3eb344c6

Attributes

url4cnc
http://91.219.236.27/trentopop
http://5.181.156.92/trentopop
http://91.219.236.207/trentopop
http://185.225.19.18/trentopop
http://91.219.237.227/trentopop
https://t.me/trentopop

rc4.plain

rc4.plain

Targets

- Target
  
  03cc67fc770fead507e30c951cab5e55c897b78f7ec39b37d3569ebef8f6df3e
- Size
  
  140KB
- MD5
  
  0c23fac57bfe5c066a2ad7054d7b20f2
- SHA1
  
  d6499456caf9837ce65a7ddc00064fb48cb88de3
- SHA256
  
  03cc67fc770fead507e30c951cab5e55c897b78f7ec39b37d3569ebef8f6df3e
- SHA512
  
  2b2e070a3ef241ee6aeb2c4f3a2ddeb262c51b9124448846f3461c9ac966ca23ca43890d030ef554ef688129e7e87f019fee7a9284d4d879e9aec87babae5fd6
Score

10^/10

raccoon redline smokeloader ddf183af4241e3172885cf1b2c4c1fb4ee03d05a e0a5b6f1f905520b5671c84d59bd182b3eb344c6 backdoor discovery infostealer spyware stealer trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

raccoonredlinesmokeloaderddf183af4241e3172885cf1b2c4c1fb4ee03d05ae0a5b6f1f905520b5671c84d59bd182b3eb344c6backdoordiscoveryinfostealerspywarestealertrojan