�|7�r��kY%�qHq2,�QKK�p6D����l牢۷y����]/!O�t#d�t�K��Z'�V�v/�`�%���2&�Uo���l8��ܤ��Y��Jtf� CE����l�q�Qx�ڛ����x���lˁC�b�U}�� x���%� ��@���`x��}����:�r`L��K:��u��uɉ��>�xQLN��YN�]�y��q7�TOw�i��.�;� ��.�#�]��ep5�A�ҎO��4��H UP��{���q��H�xؒ4smZ=͛Б:+΅�Fnv��D�2�Tш���o�k�\J:UH\yx �w�~��,��%J�;J�����Vʏ�/����`&+��eM���� (qj���\7��i��ل�G��0��e��K���������u�����=�:b���A�r������!���ⴇ6|%���珁�Z4�yW�5�HI�`��]��[V��C�����K�t} ��ߋ�ןW֯�s���A>^@���p� Q��y��@���HDž��醢��~vY���x�"��&�] c2����ơ���'r�S�Uq1��s��a��hٚ.!q�����h��ȏ^�W��&;��K���%D`ȩ����N4�Kۘ���'�?�T��O�{6��j�/�����/.0ξo�U.���[���¡�g��AM�/�$C�e���!�LhaZ�k�UǚN�}���Ȼ�]�ٽ���y ���#�ʇ~�,� ��I>��1Yv� � kM��ʞ���yu�{����W�s�� oT�l�>q�q D0�����Ju�� �㍵Y��Tjp#�U��-rdfS��;=\A9̑=��c�����)#��@<v ���^�d�V��rm�ha��vm�wL��5/4!3�x��b=���fw�����DM�!� j�����*q_ʣ_L�R ���b����fM������|��f�R���B�N5����I���]��O�C�_^�����#.��<�@��|�(Γ�$� �� c�6����!��'`&sA�EG=�z+ �U}`�BT�Y�H� �f{W2R"+��v����&��g?�Tc�������{ ��TB��q�� de%�mp�j��j�n�\x��a�V+�k���a#��~Rm�P�9�ϩw@A �m�G�֨���S�Ԕ[i馤锿���ﻫ����"ͩ,� �7=�$��� r�d���*��|j����J�#�X�"7�?/��Ӕ�=k� c��Τ=�eD�� *tK���y:k�V�$�!+��ۈC�G�?E���Q�t��=t*M˾��y<�ޔ�<E������?�2�!��� :y�A��I�)��E��H|��h��2l�Mo`n4�|��=L퐂�lT";v��bBJ����)ֳXF��f�ˇ4gA���'�op@��� ����j��6�h@�b�l�)�b��e.N�C�"���@����iQ�'U~�,P{NKJ�n@����&����Ki��Gz�!��U�F���onEp���Е�9�X4.ۙ�Sᑤ�R+���������Ρ��1N�M�J�Է�Dt8END �o��.�����K�*ީ�9�kN�迗�3j���ZX�k'��SXz�}��;_Oa`�-ҙ�y���-u�˃:#{�¸F���8%�D�RWl�����jP�L���5�6��Nz�IA��J1V4ׅ��7�1�~��GTCAl4��L;�s��>����&�x������� :к�.�u�VǧX��kxH�KJ���ri>������`��<]7��]#y-9y8�{ �o�t�+������u�A�֪6n�|���߉��ڇ]�KT��P�O�E�ڿ%�xj�.�8I�hFp ��_��<D���!2Tm�}��k��V��K=����ri��x�}�(o.e loI��}�h��b<��e)<���e����`����ͪ�s��3=�D�t�����G�A���K�Ԝ�����v )�7��c !u@Z��6,2��t�S&����6W�(�ghzToU��oX1��N�nF���4�P�5��I���V�-��U��:\���I�3��P!�E�o5��u�"Q�U�ƙ�a�'g��&��ˇ�B�n{�G��Ynud7��C}�u��fC��$�3̗�'�����8�D]�u9� G��������8B(�]9r��rW��-�{��ܖS�l� S��`F֔����� �z�K+������=n�+4�����`H�C��������w��T�p�Ok�q�:t��^j��]4@��A6ix���}j\� ������]����i����J)�Je�2�ښ����Gw�2��Mj��T� $�L�1R�ۄ\���U��q q���h7h�ߩ{��o�Uĸ��D�4��t�(�~���� �'!4� U�?BE�FkC���7�l����^��]�4�rT����;��y������9�|���Z5�%+\E ��>��ҳJ��������{*i �hǕ7mv�]%��̭�U��W��W|j��O�H���o�����: &��P�y�� Vo��K�7)�,�*����g-7i����c؝��`�q���)����A+�'��r���k�˞��<V������5j�f�Ȏ$��|�n-�����S��.p��N����AI�⫻o�����9�����mT�EZ�S3'��%����Ƚ0ޙ�,!Y���j®�r��,� G�T��i�� ��bi��r�Q4o�t%�o^nB#cN��a&��La�77p�/�-�j�������l�LT2�ha[����i���p��cGƂo$Ra#����`�dD�<v�dhw���GSK�_�R�P3!�����`/�� t��ŖB�I�Gos���z�9���*p��������m�2�|���(�l�M��ȃ�y}�l��e�kج�"�`{�.�`mHj֞Ne=�m���l��u�l1�S�h��M�JV�[G8$;f�l���I^�Y!�KЧDg���K�߶1�X��^b@�p��A�nPM7���<��B]���'��M�*^���@� ��(�'��Īʆ����L���[�� ���
Static task
static1
Behavioral task
behavioral1
Sample
99834c9981535b584040fef84af159e5e584927aac4a6a57001ba5ecf1e869c4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
99834c9981535b584040fef84af159e5e584927aac4a6a57001ba5ecf1e869c4.exe
Resource
win10-20220414-en
General
-
Target
99834c9981535b584040fef84af159e5e584927aac4a6a57001ba5ecf1e869c4
-
Size
7.4MB
-
MD5
22d27186a79cfc261d19611645c0c4f1
-
SHA1
a87f22dba40c522889764dfb1aeafe2096d929d3
-
SHA256
99834c9981535b584040fef84af159e5e584927aac4a6a57001ba5ecf1e869c4
-
SHA512
a93dff567253395f7073b49c319f5b6fefed34f6a1e0907280baf2623d6dd4ba8f1eee407620480c3a568340e6b964cad1e3e8d38c57ac4118c9d2343f05225c
-
SSDEEP
196608:98B4oxXK/H0R4c27L8QZ4LxbCbEqIlmSZNa:98BhXk7c27jCbCbyvNa
Malware Config
Signatures
-
Raccoon ver2 1 IoCs
Raccoon ver2.
resource yara_rule sample raccoon_v2
Files
-
99834c9981535b584040fef84af159e5e584927aac4a6a57001ba5ecf1e869c4.exe windows x86
0c8702090f96587df3ef3cf88157ac42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|J} Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.!H! Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.q,x Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ