raccoon | 175f4911374a35c16c2c51c839228f89a2548343ef50db64c59e59a343d55d39

Analysis

Target

175f4911374a35c16c2c51c839228f89a2548343ef50db64c59e59a343d55d39.exe
Size

446KB
MD5

ddf88046ba44b91de71f57507250d73b
SHA1

4f669eef88bed51aa29c8443b5f74491caf87f52
SHA256

175f4911374a35c16c2c51c839228f89a2548343ef50db64c59e59a343d55d39
SHA512

919597aed8cf7549d2d31e9d889eaca27fbe5e6e42aa6e5b59bfd1a6c5aa16a3a2cea3c77b56fa82dc702c232cc3a244e5b1e2d3ca2b3c2528ee3b5f2747b463

Score

10^/10

Family

raccoon

Version

1.7.3

Botnet

16992cd33145ccbb6feeacb4e84400a56448fa14

Attributes

rc4.plain

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/964-56-0x0000000000300000-0x0000000000391000-memory.dmp	family_raccoon
behavioral1/memory/964-57-0x0000000000400000-0x0000000000866000-memory.dmp	family_raccoon

C:\Users\Admin\AppData\Local\Temp\175f4911374a35c16c2c51c839228f89a2548343ef50db64c59e59a343d55d39.exe
"C:\Users\Admin\AppData\Local\Temp\175f4911374a35c16c2c51c839228f89a2548343ef50db64c59e59a343d55d39.exe"
1⤵
PID:964

memory/964-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/964-55-0x000000000095B000-0x00000000009AB000-memory.dmp

Filesize
320KB

Download
memory/964-56-0x0000000000300000-0x0000000000391000-memory.dmp

Filesize
580KB

Download
memory/964-57-0x0000000000400000-0x0000000000866000-memory.dmp

Filesize
4.4MB

Download
memory/964-58-0x000000000095B000-0x00000000009AB000-memory.dmp

Filesize
320KB

Download