General
-
Target
dcef66dddf36254f37477c63009b22c4.exe
-
Size
171KB
-
Sample
220802-v4benaaeeq
-
MD5
dcef66dddf36254f37477c63009b22c4
-
SHA1
f4e3dc7c3f507bf39dd4c5d21b8be7a1d12dd35c
-
SHA256
f245364c960d91a6e887f9a130db3675690c4c1251f3ed99aba17122c93866a9
-
SHA512
0e8e9bc68ebdcb7b25b2b732d0829d7c380664d90eab68b086c6897a9a45c8875d2ce4a578b099e56e384956ec390e0d8e0492b704ee43cfa88834c7d6e53a05
Malware Config
Extracted
raccoon
125a9422607402ad773f580d72e3170b
http://91.242.229.142/
Extracted
socelars
https://hueduy.s3.eu-west-1.amazonaws.com/dkfjrg725/
Targets
-
-
Target
dcef66dddf36254f37477c63009b22c4.exe
-
Size
171KB
-
MD5
dcef66dddf36254f37477c63009b22c4
-
SHA1
f4e3dc7c3f507bf39dd4c5d21b8be7a1d12dd35c
-
SHA256
f245364c960d91a6e887f9a130db3675690c4c1251f3ed99aba17122c93866a9
-
SHA512
0e8e9bc68ebdcb7b25b2b732d0829d7c380664d90eab68b086c6897a9a45c8875d2ce4a578b099e56e384956ec390e0d8e0492b704ee43cfa88834c7d6e53a05
Score10/10-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer payload
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-