Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    290KB

  • Sample

    231206-j83h6ada24

  • MD5

    c4a6d45c1681adc54d23963e22792cd2

  • SHA1

    3c78b51fecc2e1f7103be16bc20f562ab3d85861

  • SHA256

    6af109fc0adbf4d70eb2559299b138f2ff0987bc441b80ea1f18879540ac4638

  • SHA512

    d102f7a4e8d71f60155497d19877658bff64ef44d5c22ecfbf08245ec36cb1029ac7d763e0b070e97dc7833048961cc31a0b884deaa9188c6c33fcf125dd14f5

  • SSDEEP

    3072:MbPBwvnmkQ51yEEIUiuq7s1j2UHRK9mMzj3t5UM6aVdbVryTk+:8wvygEEIUtMcj2uqLzCY52T

Score
10/10
raccoonsmokeloaderbackdoorcollectionevasionspywarestealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/
rc4.i32
rc4.i32

Targets

    • Target

      file.exe

    • Size

      290KB

    • MD5

      c4a6d45c1681adc54d23963e22792cd2

    • SHA1

      3c78b51fecc2e1f7103be16bc20f562ab3d85861

    • SHA256

      6af109fc0adbf4d70eb2559299b138f2ff0987bc441b80ea1f18879540ac4638

    • SHA512

      d102f7a4e8d71f60155497d19877658bff64ef44d5c22ecfbf08245ec36cb1029ac7d763e0b070e97dc7833048961cc31a0b884deaa9188c6c33fcf125dd14f5

    • SSDEEP

      3072:MbPBwvnmkQ51yEEIUiuq7s1j2UHRK9mMzj3t5UM6aVdbVryTk+:8wvygEEIUtMcj2uqLzCY52T

    Score
    10/10
    smokeloaderbackdoortrojanraccooncollectionevasionspywarestealerthemida

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Email Collection

1
T1114

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks