raccoon | 0744e2c799a703a10efb5c0f857bc729113aa31ce8a873e65ae3df311a2d35f1 | Triage

Sharing

General

Target

0744e2c799a703a10efb5c0f857bc729113aa31ce8a873e65ae3df311a2d35f1
Size

140KB
Sample

211118-acmy6aedc2
MD5

9f4d03d447a7851c90ddbfafde877e45
SHA1

5761d42617a44623f046943c0e2c31583f3487dd
SHA256

0744e2c799a703a10efb5c0f857bc729113aa31ce8a873e65ae3df311a2d35f1
SHA512

f842f593034915d723c55f2fd84d5297e11cd5eb86b3bc1fd03cd3a8623026b973178898b1832348e11c4861deeca20cb514762b60d661bb3892d3890cefcb0e

Score

10^/10

raccoon redline smokeloader ddf183af4241e3172885cf1b2c4c1fb4ee03d05a backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes

url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar

rc4.plain

rc4.plain

Extracted

Family

redline

C2

185.159.80.90:38637

Targets

- Target
  
  0744e2c799a703a10efb5c0f857bc729113aa31ce8a873e65ae3df311a2d35f1
- Size
  
  140KB
- MD5
  
  9f4d03d447a7851c90ddbfafde877e45
- SHA1
  
  5761d42617a44623f046943c0e2c31583f3487dd
- SHA256
  
  0744e2c799a703a10efb5c0f857bc729113aa31ce8a873e65ae3df311a2d35f1
- SHA512
  
  f842f593034915d723c55f2fd84d5297e11cd5eb86b3bc1fd03cd3a8623026b973178898b1832348e11c4861deeca20cb514762b60d661bb3892d3890cefcb0e
Score

10^/10

raccoon redline smokeloader ddf183af4241e3172885cf1b2c4c1fb4ee03d05a backdoor discovery infostealer spyware stealer trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

raccoonredlinesmokeloaderddf183af4241e3172885cf1b2c4c1fb4ee03d05abackdoordiscoveryinfostealerspywarestealertrojan