$�Z�Ð,Ff���[�A��:&?���,#J=�q�ҁ���<�N�|)�$��˘��]t�Pw�P��=����$f$,��i����˯i�S�QA�pP�z� �:���� �� ���0��3����"��m���c����K:��YH�$��[nV��.,�.j�?��CB���Se�''�u��=_t�V�7��ar�g�ԣk�����j<��� ��R�g`�uH]#�1��j/tz��ς(��a%��+�dBp;��k�`S�9 4�?{�����T�R(d�2�����a{f�Jº�!c�z���H><d�Q)dH���u!{z8�"��� �Ï���Ͼڇ?�jM ��t�`���k�:����y�z�Z��c+�� �?�K�˽���>���Nvl��)n�W0?*�t��� ��T�j�Q���(��I�ު����2(&�Q�#A_ ��Vo�$�t`���-�5��,�xM�#�4����ٛ����^�F��y[��ls��/HPfc�q�i�t+Wb�ۃ YX�8���ޝ_Q��*�V��"MKx��ČeRO��Q����]6�)�{ӿ$��>`K���W�����%�v<u��AR��=�!#�k���tH H�=[���e`��pG�v���\ Z�Q��� h�=��k���L��g|�g���I`���R%�&[�xd�R��0*4�q����`���MKu^���aA@c��!4q�A�qB���͈����<�̚e�G^����5|�s�+73�����=Љ'ZD�J�i&r�c]�I��+�j(Q|`�eA_\� #��[�\���7� �%m�t3��O\!�<�5����X��_AT$��)Y�C$���X$�=��2��6A!9�������wݹ:k���V�|��8đ�~�N�&��e�@��)b_س҈�|���]L�!�5����\����\�먃j�x�%[�S�[�.��9;RHŶ@m�^��f���,b`�C����ctP���%K��(\�����S�?�&���cm����D�O�ӵH��h+���o)9�%]�t��㵐gd�3랖�&Ox0�bX��0y��� ��Th]��ۍү�E�ga��2I�Eغ.�G<��ۤy 9��1X��M�`o����g�@ɉ0� ����-�j��0�2�L��uQ��B�������2��C�������H�G%�O��V�N��]/ᱷ I�R`,b��`Y��z�?����=Ƹ�a�&��W���/�9X /�B)��CN"�L�1�`���_ ��N����F=4}B3���#�C�֧RP/=����g>#��u����f�p� �p cՀ;ђ����,���)�+n����;{S�h��;Q��K�|��N��sp�\���c� ���D9��SVATS�T��� |�T�SC@h��Y���zbEa��n�0Ƚ&Vw觬��ާ �D$�Ƹ�j�/M-��`V����R�w_�#Xj1��Z��K#��ޜZ��;^ !@iIz�4d.1�n��߇�ړ���(�6zQ�8T��!�AAH��f�_�ծ�1� ��#>Qɉ����Z��Wh��S�u�[��3\,[�iy���� ��Κ�ﮫ��>�o�r�%f�YIj���[18�19}�' �p��y.��M����*�N_5W���\���\�+uN }�srW�V��͡/�P���^(.e��`|�髐�5��3�e���9�2c�j���G���L��)9<��E�2VO�ʑ@tU� ��M���p�>b��|����NP��V���ޝ���;���� @�x���}�I�"rz~N~*l�ʢ^c�n�.�Ki�S?��=�j&���0Ơd�3x��Q�TJ�����g#�?*0�̾y���e�'O%m^���f���Z��ΟmaHf!�k�`�F.G+1#+�Ϊ��\���^M�/F�r����\nl��� ���� ��BƱX��w)�d�l�I�sڊ"��Ϭ?���.�W���;8�#� ����h]����(���tWY�C䵛�Q� bL�*r>���� �� X�?��)Y�e����u�c<�'� ���������;I �eR��8>y��1R^�L�-yk�<�ص�lh.fFb�'���л/�^�ם~C�����N?kH�o�,%<ya �8[�����6�A����ȟ��%"�H�hz/2]-�A�@�y��MlwHL,z�C���B����E�1�H;K� �[�֧a��M-�"e�H�� ��1�pfL�ڛ�o��dl�����Pu��r;����n(�� �S$3ذ�/WE��U���Lo�A������UG�JC���c$�Pg�wi��B$?ªd%�D��mٌ5��Y�����_~5������6�� 4�Ba�����GK��׀@%�4Z,��<�������H4�0�9qM�2��N��lZzp��1q�]��ij.����0 �-������1��u��Է��R�D����<��Ԥ�@D�Ե�0R��� ��M�F)�B<�T�[q�,��b����}���|��+��&~���a��z�ĉ��cBKې���i2������77�|�Rxػ�_RH������������F�:F_ZNV�._�@��v��8�{<)�izIa�~J��L������Q�-><���=�\��='z�B˜ }��ub]�e�N�ǟ�8������q ���g�s%���e3����f�|+躊�v��W���_k<~{���fOυ�_yںb�� ��ۑ�F��G�����(�28�2�K�O�u�a��W��,�>̢+�����91�&|���~�[��_�wq�&vY������s�dr��4���::f*祕��h@�G #b�l���O3��" ʏggyr~�(x�����Ƈ�b������.B��/��?aF4�����1�|��8�֑�Ef)�\�mǔ���1U���.�T�89x8�8k}F3� W�k�<�<��gy���]E���v�����VlA$���9�K���9��6����*в�� ���#9�L3͈�v���͙���t'D�i
Static task
static1
Behavioral task
behavioral1
Sample
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe
Resource
win10-20220414-en
General
-
Target
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d
-
Size
7.5MB
-
MD5
54e884a1b12fec5e6beaa3a3fc431bee
-
SHA1
e7f866afe8e34c722f8dbc5057e47856e37fa0ff
-
SHA256
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d
-
SHA512
863de15037dd1ef165387c3f8a7aaa4526aba11e2fbc4ef1e15c3b2f7c768ca154c35724b5ab5e8ad6a37e30959d19cb09e7d0a63fc9f78f730a00a79307c702
-
SSDEEP
196608:UmPB90XAv3GZXxFxyUdmC/QqDUXoi+0D4e65R:UAn2bmQmniYoXq6
Malware Config
Signatures
-
Raccoon ver2 1 IoCs
Raccoon ver2.
resource yara_rule sample raccoon_v2
Files
-
494df1513b13c70b1472282b80bdf1a9399ae0d16a90275a5c9fe7cfda6afd0d.exe windows x86
0c8702090f96587df3ef3cf88157ac42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetUserNameW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>z~ Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.esA Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eec Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ