raccoon

General

Target

0bc400e0c63e1cb1f40eba909fc55875010b6d82efc5142a1dc2d03294080463
Size

160KB
Sample

211119-ktqfqachc7
MD5

a4e282a9b67616245766901f1cfece53
SHA1

91b41dfd89e90ece75c9a0d1760b5ebc63fe4507
SHA256

0bc400e0c63e1cb1f40eba909fc55875010b6d82efc5142a1dc2d03294080463
SHA512

7056cab7862c904e05784bf662ad9866f23da4d988e56241d3392278119436b19c27e3f324edfc75cfe3b4e5f5593a08087976ed4c2b5a1758f0728a78e8326e

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

http://rsuehfidvdkfvk.top/

rc4.i32

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.29:1102

Extracted

Family

redline

Botnet

1811

C2

95.216.168.100:38784

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

14b265e74e2847e8408db7ca21fe6fe2e9ab5767

Attributes

url4cnc
http://91.219.236.162/masterdanteloma
http://185.163.47.176/masterdanteloma
http://193.38.54.238/masterdanteloma
http://74.119.192.122/masterdanteloma
http://91.219.236.240/masterdanteloma
https://t.me/masterdanteloma

rc4.plain

Targets

- Target
  
  0bc400e0c63e1cb1f40eba909fc55875010b6d82efc5142a1dc2d03294080463
- Size
  
  160KB
- MD5
  
  a4e282a9b67616245766901f1cfece53
- SHA1
  
  91b41dfd89e90ece75c9a0d1760b5ebc63fe4507
- SHA256
  
  0bc400e0c63e1cb1f40eba909fc55875010b6d82efc5142a1dc2d03294080463
- SHA512
  
  7056cab7862c904e05784bf662ad9866f23da4d988e56241d3392278119436b19c27e3f324edfc75cfe3b4e5f5593a08087976ed4c2b5a1758f0728a78e8326e
Score

10^/10

raccoon redline smokeloader 14b265e74e2847e8408db7ca21fe6fe2e9ab5767 1811 sewpalpadin backdoor bootkit collection discovery infostealer persistence spyware stealer trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1