raccoon | 1684-57-0x0000000000400000-0x000000000045E000-memory[.]dmp | Triage

Sharing

General

Target

1684-57-0x0000000000400000-0x000000000045E000-memory.dmp
Size

376KB
MD5

c62bf760b51e616610e57267375c6986
SHA1

6b14aff891903134645b1beb854daca4fcc65982
SHA256

4c2c6cdb37d51660563e85ccb8bf47aa7e0d90cda22989760f70f1610f0d03a7
SHA512

eb4fc7ca1e5958f5a0dadc13e23536a9f03f472199ee9dae9fe89a70abc4969c2c597d15ad44e409a0faf8edec05849b51a723476db5fbdb3ae4427a8889922c
SSDEEP

6144:EeUqBB+qio4Oo9y/88+hCq8A5sjSLioI1/0FzlbSfZK:yOBNiBZ9y03Cq8AWVoI1/0FzlbSRK

Score

10^/10

c4376f037b1703b305ca5fb81f6ffc21 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

c4376f037b1703b305ca5fb81f6ffc21

C2

http://5.252.23.112/

http://45.153.230.5/

rc4.plain

Signatures

Raccoon Stealer payload 1 IoCs

resource	yara_rule
sample	family_raccoon

Raccoon family
raccoon

Files

1684-57-0x0000000000400000-0x000000000045E000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ