General
-
Target
96fb069f6ad3ae8ad8704387d8b16fa671674b3dceaff9393cbcdc52cefd828e
-
Size
289KB
-
Sample
231205-gpqn5shd71
-
MD5
00acf4926f46b6fc821645e453fa5ef9
-
SHA1
937cd2b1efa9e0ff759bf80ea5cce255e8e57525
-
SHA256
96fb069f6ad3ae8ad8704387d8b16fa671674b3dceaff9393cbcdc52cefd828e
-
SHA512
3d9b35523674bc514376010dc9ce35579d96f3a2c434b29db30c1663e8ee52ca50f3a082abcc5d6333f15c0d065dfbed3a0f988a81779e11cca03e4a0e74da70
-
SSDEEP
3072:ncxZ6Y3oVwfVDpu2stYRHn76g2dq5Qle0pU5OaagVZkTkI:ceYIwfVDLstYRH732nFLuiT
Static task
static1
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Extracted
stealc
http://dskflherlkhopihsf.com
-
url_path
/d414f888bed8c202.php
Targets
-
-
Target
96fb069f6ad3ae8ad8704387d8b16fa671674b3dceaff9393cbcdc52cefd828e
-
Size
289KB
-
MD5
00acf4926f46b6fc821645e453fa5ef9
-
SHA1
937cd2b1efa9e0ff759bf80ea5cce255e8e57525
-
SHA256
96fb069f6ad3ae8ad8704387d8b16fa671674b3dceaff9393cbcdc52cefd828e
-
SHA512
3d9b35523674bc514376010dc9ce35579d96f3a2c434b29db30c1663e8ee52ca50f3a082abcc5d6333f15c0d065dfbed3a0f988a81779e11cca03e4a0e74da70
-
SSDEEP
3072:ncxZ6Y3oVwfVDpu2stYRHn76g2dq5Qle0pU5OaagVZkTkI:ceYIwfVDLstYRH732nFLuiT
-
Raccoon Stealer V2 payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-