Overview

overview

10

Static

static

f9d49869c9...56.exe

windows7-x64

10

f9d49869c9...56.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f9d49869c91024c5a3dd399248908e56.exe
  • Size 295KB
  • Sample221008-jptrxaeedp
  • SHA256 177fbd109bb143efcbddb2ff8fe7cc5d4af6931b5e98b23266e4e9031ef750f0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
raccoonsmokeloader17aad1e8aa2ca5164d7690cff19263909333547b6d5c69ea798fd93c66d78435backdoorstealertrojan

Malware Config

Extracted

Family

  • raccoon

Botnet

  • 9333547b6d5c69ea798fd93c66d78435

C2

  • http://45.15.156.27

rc4.plain

Extracted

Family

  • raccoon

Botnet

  • 17aad1e8aa2ca5164d7690cff1926390

C2

  • http://45.15.156.27

rc4.plain

Targets

    • Target
      f9d49869c91024c5a3dd399248908e56.exe
    • Size 295KB
    • SHA256 177fbd109bb143efcbddb2ff8fe7cc5d4af6931b5e98b23266e4e9031ef750f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderbackdoortrojanraccoon17aad1e8aa2ca5164d7690cff19263909333547b6d5c69ea798fd93c66d78435stealer

    • Detects Smokeloader packer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks