raccoon | 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3

Sharing

Copy URL

Twitter E-mail

General

Target

8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
Size

2.3MB
MD5

6c3765191111fc238bbfedf10df00d16
SHA1

343e2816c224b1ad0583c352002c041dc872d329
SHA256

8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
SHA512

35fcaccbcc69aeb2f2112b5824ae9e5cff8c1853e1bef9c89705b4c1c882b06d809301c2c077d6d4a42c0729945f2aa6c611b5453fa87c6de6ae50936b086bc1
SSDEEP

49152:DaW8D7Dlg7zV2lnQ0V9RG+YckvPcy8vx58hti3NL/hjIBbfyc8v16wEE7lqLK6p:n+lg7zs7V9cLJUy8v38ni3NbhjIBbaNy

Score

10^/10

themida 0380ce78e535082bef76630d0bceca437f338548 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

0380ce78e535082bef76630d0bceca437f338548

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1k0ymweaEst-OA_Um-D42KX8-DcDnmEAz

rc4.plain

Signatures

Raccoon Stealer Payload 1 IoCs

Processes:

resource yara_rule

sample family_raccoon
Raccoon family
raccoon
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	family_raccoon

resource	yara_rule
sample	themida

Files

8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
.exe windows x86

Code Sign

3d:88:68:41:a2:e6:be:39:4c:06:ef:33:59:40:27:b7:58:37:e5:0f
Certificate

Issuer

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Not Before

29-03-2020 20:26

Not After

29-04-2020 20:26

Subject

CN=cwvdihoe company,C=UK,1.2.840.113549.1.9.1=#0c116377766469686f65406c617374652e6d6c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e6
Certificate

Issuer

CN=Ascertia Root CA 2,O=Ascertia,C=GB

Not Before

21-04-2009 12:15

Not After

14-04-2028 23:59

Subject

CN=Ascertia Public CA 1,O=Ascertia,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:21:1a:f6:cc:64:fa:a9:87:9e:84:26:a7:9a:78:c6:d2:7e:2f:05:8a:5f:52:0a:5f:d8:f3:95:8e:21:7c:f4
Signer

Actual PE Digest

1b:21:1a:f6:cc:64:fa:a9:87:9e:84:26:a7:9a:78:c6:d2:7e:2f:05:8a:5f:52:0a:5f:d8:f3:95:8e:21:7c:f4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=cwvdihoe company,C=UK,1.2.840.113549.1.9.1=#0c116377766469686f65406c617374652e6d6c

30-03-2020 20:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

3d:88:68:41:a2:e6:be:39:4c:06:ef:33:59:40:27:b7:58:37:e5:0fCertificate

Extended Key Usages

Key Usages

e6Certificate

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

1b:21:1a:f6:cc:64:fa:a9:87:9e:84:26:a7:9a:78:c6:d2:7e:2f:05:8a:5f:52:0a:5f:d8:f3:95:8e:21:7c:f4Signer

Signature Validations

Verification

30-03-2020 20:06 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 409KB - Virtual size: 409KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 10KB - Virtual size: 13KB

.vmp0 Size: 2KB - Virtual size: 2KB

.vmp0 Size: 549KB - Virtual size: 549KB

.reloc Size: 19KB - Virtual size: 18KB

Size: 106KB - Virtual size: 257KB

.imports Size: 1024B - Virtual size: 4KB

.rsrc Size: 160KB - Virtual size: 160KB

.themida Size: - Virtual size: 2.1MB

.boot Size: 981KB - Virtual size: 981KB

3d:88:68:41:a2:e6:be:39:4c:06:ef:33:59:40:27:b7:58:37:e5:0f
Certificate

e6
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

1b:21:1a:f6:cc:64:fa:a9:87:9e:84:26:a7:9a:78:c6:d2:7e:2f:05:8a:5f:52:0a:5f:d8:f3:95:8e:21:7c:f4
Signer

30-03-2020 20:06
Valid: false

.text
Size: 409KB - Virtual size: 409KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 10KB - Virtual size: 13KB

.vmp0
Size: 2KB - Virtual size: 2KB

.vmp0
Size: 549KB - Virtual size: 549KB

.reloc
Size: 19KB - Virtual size: 18KB

.imports
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 160KB - Virtual size: 160KB

.themida
Size: - Virtual size: 2.1MB

.boot
Size: 981KB - Virtual size: 981KB