raccoon

General

Target

beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
Size

318KB
Sample

220927-q8eknadfa7
MD5

35400015b594302820a04c20fe48f488
SHA1

7099e8b6ce25dcaf4f56b17f5ff908313a2a246e
SHA256

beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
SHA512

f60f35ab9a1d19cdf7caf5f991709a0003c4bd869ff05d7ec70bac986711f1ef7295539b75d954d7d014c4b5bb0462d4341930c9ed10fa37d75895f4c6455939
SSDEEP

3072:a5TX1xkWhKsXncm25ELXJpNbDqmQdhjeXP0K5FGvwrDjVjM/h3BsxkgaBChU/pZq:a5LrfFcmN/qmQvCP0hsnigabwVf

Score

10^/10

raccoon redline smokeloader 11 aeea23901ace2687ada0edd1d2615c7f backdoor discovery infostealer spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

11

C2

77.73.134.27:7161

Attributes

auth_value
e6aadafed1fda7723d7655a5894828d2

Extracted

Family

raccoon

Botnet

aeea23901ace2687ada0edd1d2615c7f

C2

http://77.73.134.31/

rc4.plain

Targets

- Target
  
  beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
- Size
  
  318KB
- MD5
  
  35400015b594302820a04c20fe48f488
- SHA1
  
  7099e8b6ce25dcaf4f56b17f5ff908313a2a246e
- SHA256
  
  beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
- SHA512
  
  f60f35ab9a1d19cdf7caf5f991709a0003c4bd869ff05d7ec70bac986711f1ef7295539b75d954d7d014c4b5bb0462d4341930c9ed10fa37d75895f4c6455939
- SSDEEP
  
  3072:a5TX1xkWhKsXncm25ELXJpNbDqmQdhjeXP0K5FGvwrDjVjM/h3BsxkgaBChU/pZq:a5LrfFcmN/qmQvCP0hsnigabwVf
Score

10^/10

raccoon redline smokeloader 11 aeea23901ace2687ada0edd1d2615c7f backdoor discovery infostealer spyware stealer trojan upx
- Detects Smokeloader packer
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1