raccoon

General

Target

60cd649fed2b7527e447db61a5dc1abfd0a92e0af93cafe0c62f6ad0377112c5
Size

160KB
Sample

211119-pacsqsacdp
MD5

6e55ef842feee0b190d83bb9abe411d8
SHA1

e83c1f4180b6d6358c55617876b3b48acb341bfa
SHA256

60cd649fed2b7527e447db61a5dc1abfd0a92e0af93cafe0c62f6ad0377112c5
SHA512

13bc4a2f8fb9ea472c8ae6d2e0f7ccb4526b210f5c988f13ba1602f75d8d4507448614d226e5f0408b1d43e70154efa07586086f53502f6f46694a49ffa74f0c

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32

Extracted

Family

redline

C2

jaromawanave.xyz:80

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.29:1102

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

14b265e74e2847e8408db7ca21fe6fe2e9ab5767

Attributes

url4cnc
http://91.219.236.162/masterdanteloma
http://185.163.47.176/masterdanteloma
http://193.38.54.238/masterdanteloma
http://74.119.192.122/masterdanteloma
http://91.219.236.240/masterdanteloma
https://t.me/masterdanteloma

rc4.plain

Targets

- Target
  
  60cd649fed2b7527e447db61a5dc1abfd0a92e0af93cafe0c62f6ad0377112c5
- Size
  
  160KB
- MD5
  
  6e55ef842feee0b190d83bb9abe411d8
- SHA1
  
  e83c1f4180b6d6358c55617876b3b48acb341bfa
- SHA256
  
  60cd649fed2b7527e447db61a5dc1abfd0a92e0af93cafe0c62f6ad0377112c5
- SHA512
  
  13bc4a2f8fb9ea472c8ae6d2e0f7ccb4526b210f5c988f13ba1602f75d8d4507448614d226e5f0408b1d43e70154efa07586086f53502f6f46694a49ffa74f0c
Score

10^/10

raccoon redline smokeloader 14b265e74e2847e8408db7ca21fe6fe2e9ab5767 sewpalpadin backdoor bootkit discovery infostealer persistence spyware stealer suricata trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1