��9:,q�73����<�2uv����;O,e��b�a�֪�w�e��ȍ�'P۬�=���� ʖ�ne6�(��P.́2̀%�^ ��8' �<�d�l�� �/�)F�0S(6�g&����%�c�#���{u�' �0'��oZ��5�/c�Ѡ���YY�X�}�ť�O����j�x��v�Ƈ��~��R�gfy�oM`�M�n��Jr�9���'��_���[�� 6MS6��E�b?�]1���8�O�7?h�U��(�P�� x�W+t��@A�Z�J�2c��.hV�p�;�%Sh"6|G�.��b�����D��Ch��) J�|'��t$�W�ml]D�/�)0�/�2 "�p��[?�h�� f�hd�$L�U��P y˶��*�!����$�~��l�(j��#1���D��*kaK� ��&����lU�){|�2Q�5�n�m%HSj���[f��s�����L�g ��=��;{���N���Ym/�+p9����A��-W�+ #'%e�_�Aa;�=��B�b�2�uYr��4�9A��7��㍿�F�!��/6�AʇF�a�M<���}5h����5�����:���&;���%�@1����6���J�1���{� �������-pi4ovȢ��{Ծ�o�{S�W�g8*n+���P���9ے��Ԥ�Mu���:�G������Τ2GԈ˾nJ&���(W�J��=u�+p��wU�z��tQ���C�m���h��c�I}�3B�q�.�<��} ض����S����s,�=(Z���x,a_)�_��r5�I��p"� ��&[W�[�ɾP�g��*������x�M�1�9Z�1�U��#��E�S��~{x$ غ�KP�J����*غ��j��P�r���d���Ů�j�+ˎ��U��5�,mMN�1�hެ>!��%D��>�� �=J�K3�0F�~�f�Ɛ�خى���!zk\jK��ޒO��5�d� s�W��V����ũ�o�8_j�(���{c�dP��R���Fؿm����g�'�)T�X����I���w�:0�.� �\�7 J\h����'��>��b��x��QnŜ�?0��^��r��8/�9q�3��̈3��xUC���B�[���FCM:nQ��,e�{)��$��{ye��c��������<u-�h*�>e���B�VϦo��bxF0��5�~��="��#�P��/I>�6���h�B)xR��U�!�:�Ot�sp_ܾ��&.����}����2�H�����ٳ���@��s�}��'�>��Qm1��a��q=�kd�+U�_�����\��I�]�p����h���pč��Ds�6����W�Z ����ŪoC.����G�L����(h�R,0�n�QR$��9�XBkp���a���4��Ã}J=l�5fG(���+�0�[0��s�zM��z�ɦC��v�DnE �"����^`���z=l���sܶ%��*e\p5Ԇ}������4�t���_)\�mQ��ok%��d6��&K�� ѹ��`����b��p�z���{���_���0�B�e�C�WXmV�Q���,�za�C�\��4��vc ��� _�E�D�<��6s��닻M :�;Ed�l��0�)�!��y^h��1*<ց�l�ԗvg z�D�Nl?�t��~W�D�I|�^���P~��▪7�WRk��}�2.3[�������e�ެk�z��R� A#a�Oy6�;{���ʗ���r��o�b0O�!�Vb6�WmjDO�LZ��$�w�C=��-����ߛ�R/H��qx��s�%�Q����z��)������>�1����2,�� �k���|�GV�&et1�yrh��G��#�� ��\r������zd&(3z�E�l�����87'�����Ļ�i�c�v��#Um��&-����~�b�JG��K��[����`�W�U�j�t�X�&؛i Rsw[���ak��f�F/#l̳h�����GȊ����fA}��?N:~ߚY�H�Ka����ѴXS�z�HC}y;�:o��%��Dz!F�,tc���3��)<�m�Q���y5��!0�ܻ~��b�j�j(C-�@�a��g��J�erטm����8����C˔j������NT�a�S��U�����N�L���Z1m_0���(���^���T��^��,t���u�ꚺ�v��,�H���+) �!�q��>X1�-e.�åc�/T7�L�O���m�s⚑`��Wa���i����sp��F�al�0"t�����|PT�~���U�C|��F�c�PM1v��?�D�~�N�sˉ���ȯ�aT����z�b��3ȑ���[4�������<l;��rR�HNJ�[͗a��~��Y��lj����hX��l,����ii�~�b�� � A`#�����OT�B�'���Jy7�^^8K0j��g1:�������g�����bW�� ��*K�=jDIT8(8 T[�5����q!��>�J��� D���u�o��iá霂�1y;yJ�3\�B���|�koZ��?ȅ젹K�_YT�>e�0$��@\�UrqE�#�F7�&�v��7�*�_ �pu'F��]t�4sD�/��וp��W]7<����G5:U���FEX�ޔH�� �gkE��m<!�}���WɊ�3I�����/Y�����b����0G����o��[�^�cH~�E.�Tq����"��&�q�kDe�v��yO��B����P�V�0�d�M �qԜY_�/g���>�{2��f��_ةK�B2B+���|0�B�j��������5����wѹ�� % gP�L ��DU�.�I��u<����� ��u�UA�̭�!��t�}��TF��߂�ӥe��HVP0��ʇ� ^]<g�ޜa������TAB�����TCf]�{K�YD�B6���d{����/�i߀����?�+Uj��3�F(eBLY��1���� .P}��.��g��@!�� �O�����ϡU��bo�|ެ����r���7G�'>�~vBg)�zI3��}^���Ľ���*?\MXL�͓3d�3�[����z״����f����
Behavioral task
behavioral1
Sample
Cracked/install.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Cracked/install.exe
Resource
win10v2004-20220812-en
General
-
Target
cracked.rar
-
Size
5.7MB
-
MD5
d34745a19676c3e563e428ca0cb9d957
-
SHA1
eaf29006149605124878c1b5b133e462714c3163
-
SHA256
32e5c363376a05a0b4eef0518c354784682e4b21ed8a061b55fa75e38ed44928
-
SHA512
f420634ed874eb23d5a21088a89fd7c58a782e21caf6bfe111c7227136c7d156ce0a2582ed8d29c5ab19010ceaade83c62edc9a2cb3454819e97c21dc3bb8a0c
-
SSDEEP
98304:p13z7OgAbRlsKXmnUK2pLEJF//ibKb3EXjHnXy4OzjNDgJLZ6aQoewpAaDP8w:33HOgAtHXk2pAJF/33EXDXy4SluMNs
Malware Config
Extracted
raccoon
cfc15cd93d761e5ec230398fac671d07
http://193.149.129.12/
Signatures
-
Raccoon family
Files
-
cracked.rar.rar
Password: 2022
-
Cracked/dataa/Data/16.0.15128.20264/stream.x86.x-none.dat.cat
-
Cracked/dataa/Data/branch.txt
-
Cracked/dataa/Data/v32.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v32.hash
-
Cracked/dataa/Data/v32_16.0.15128.20264.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v32.hash
-
Cracked/dataa/Data/v64.cab.cab
Password: 2022
-
VersionDescriptor.xml
-
v64.hash
-
Cracked/install.exe.exe windows x86
Password: 2022
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xyz0 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xyz1 Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xyz2 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ