raccoon

General

Target

3996a39b0a3c77630ae685801812a31797a96c5a27a31dd2f571da2e5127a4cf
Size

291KB
Sample

211219-aflkhagehn
MD5

ee908541b3ea872846fc7052f2a8c995
SHA1

d03ed3988d42dffae468c6a18b96bb9c12ddb2cf
SHA256

3996a39b0a3c77630ae685801812a31797a96c5a27a31dd2f571da2e5127a4cf
SHA512

4f0a931190de4cc55d6bf3e6ca4068ca9d2171d9f1b2fde56795e0a9c23b64317451ba9a8f5d8bd55a71a789a74c5d8ebd9697801023c4c9107a9020574d77a3

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

redline

Botnet

1

C2

86.107.197.138:38133

Extracted

Family

redline

Botnet

170

C2

45.9.20.240:46257

Extracted

Family

raccoon

Botnet

0efc785fd840be1c87bf9a41a244f3fae2a1e3c8

Attributes

url4cnc
http://194.180.174.53/azbukaabc1
http://91.219.236.18/azbukaabc1
http://194.180.174.41/azbukaabc1
http://91.219.236.148/azbukaabc1

rc4.plain

Targets

- Target
  
  3996a39b0a3c77630ae685801812a31797a96c5a27a31dd2f571da2e5127a4cf
- Size
  
  291KB
- MD5
  
  ee908541b3ea872846fc7052f2a8c995
- SHA1
  
  d03ed3988d42dffae468c6a18b96bb9c12ddb2cf
- SHA256
  
  3996a39b0a3c77630ae685801812a31797a96c5a27a31dd2f571da2e5127a4cf
- SHA512
  
  4f0a931190de4cc55d6bf3e6ca4068ca9d2171d9f1b2fde56795e0a9c23b64317451ba9a8f5d8bd55a71a789a74c5d8ebd9697801023c4c9107a9020574d77a3
Score

10^/10

raccoon redline smokeloader 0efc785fd840be1c87bf9a41a244f3fae2a1e3c8 1 170 backdoor discovery infostealer spyware stealer suricata trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1