netsupport

General

Target

e352d965c941c9f5ad24b3792eb2df63def63b23c628e611aa2b12f4636b7733
Size

301KB
Sample

220911-rbgjesbfg2
MD5

13cc9f2795d48867d8b96ac4d283c2e2
SHA1

502e7bd29a4ee956a4834f6c2b82ed2af251523e
SHA256

e352d965c941c9f5ad24b3792eb2df63def63b23c628e611aa2b12f4636b7733
SHA512

17c910083694dab8d07e40fa27d24828a24c6074f6e2502aa3fc12fe0ce71bd553d558d9300a011fdeeb73dc01107b20127d58133c84c01ab93a459893766b7a
SSDEEP

6144:OnecA48y3yla5qFMmXfB1eKqMgtHjxWpUjhSNN:Op33ylyqFMmXp1ebtHVfh0

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

567d5bff28c2a18132d2f88511f07435

C2

http://116.203.167.5/

http://195.201.248.58/

rc4.plain

Targets

- Target
  
  e352d965c941c9f5ad24b3792eb2df63def63b23c628e611aa2b12f4636b7733
- Size
  
  301KB
- MD5
  
  13cc9f2795d48867d8b96ac4d283c2e2
- SHA1
  
  502e7bd29a4ee956a4834f6c2b82ed2af251523e
- SHA256
  
  e352d965c941c9f5ad24b3792eb2df63def63b23c628e611aa2b12f4636b7733
- SHA512
  
  17c910083694dab8d07e40fa27d24828a24c6074f6e2502aa3fc12fe0ce71bd553d558d9300a011fdeeb73dc01107b20127d58133c84c01ab93a459893766b7a
- SSDEEP
  
  6144:OnecA48y3yla5qFMmXfB1eKqMgtHjxWpUjhSNN:Op33ylyqFMmXp1ebtHVfh0
Score

10^/10

netsupport raccoon smokeloader 567d5bff28c2a18132d2f88511f07435 backdoor discovery rat spyware stealer trojan
- Detects Smokeloader packer
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1