raccoon | ba2aa8a7a06cb75e72da6f1ac6fb382cc8b671d5d780a34fad8c186fa948e646

Analysis

Target

new.exe
Size

524KB
MD5

8898e8baca8dc42177baca235671d6c5
SHA1

057e767b3ad0b3791d165e676a16bc060fb5d7a0
SHA256

ba2aa8a7a06cb75e72da6f1ac6fb382cc8b671d5d780a34fad8c186fa948e646
SHA512

764f6e76e4a5cf71fa7c81fcebbe738c8fc8cca09292b8f115a3dc9e7c50a5095a70eef3b4cf1c3000429b8d4f0abdbc7ab8e3fef70def61d3fef92cf765fc58

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

bb8d3701ca5d8e031967c87b862623b34997b3d1

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3060-127-0x00000000024F0000-0x0000000002581000-memory.dmp	family_raccoon
behavioral1/memory/3060-128-0x0000000000400000-0x000000000087C000-memory.dmp	family_raccoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4916 4172 WerFault.exe

pid	pid_target	process	target process
4916	4172	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
PID:3060

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 4172 -ip 4172
1⤵
PID:4896

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4172 -s 856
1⤵
- Program crash
PID:4916

memory/3060-124-0x0000000000A61000-0x0000000000AB0000-memory.dmp

Filesize
316KB

Download
memory/3060-125-0x0000000000400000-0x000000000087C000-memory.dmp

Filesize
4.5MB

Download
memory/3060-126-0x0000000000A61000-0x0000000000AB0000-memory.dmp

Filesize
316KB

Download
memory/3060-127-0x00000000024F0000-0x0000000002581000-memory.dmp

Filesize
580KB

Download
memory/3060-128-0x0000000000400000-0x000000000087C000-memory.dmp

Filesize
4.5MB

Download