raccoon | tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

6.6MB
MD5

bbb791dc346414b06739764cb3e47345
SHA1

b73af72892530658db805d661ed5b13e4d57a24c
SHA256

17b1637d3f5a6327ed8cdcc2ca5443d8a41b497658544b63acd50564f9e30ee6
SHA512

fc63f254eb0ba93dd34b0338411ac35a23aa7bbfeea7c178bfd2c9ff08e3aa713acdf3ff8e57889087567aa8796fe37d937e6f441b3c949289aa58935f6de348
SSDEEP

98304:lBNRaOAmwvIlhz/Fou0s4fjOXOrL529OoPP03o1bbQjxtc3:lnRjrFouXEIOo3eo1Mxm

Score

10^/10

raccoon

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon family
raccoon

Files

tmp
.exe windows x86

4d1adbd615da10f5981597929486306c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:3d:ab:af:ee:c2:b9:6b:34:c7:e3:33:c9:51:58:8c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/10/2020, 00:00

Not After

27/10/2022, 23:59

Subject

CN=Yonyou Network Technology Co.\,Ltd,O=Yonyou Network Technology Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0e:e5:58:31:c0:12:aa:41:07:29:30:e3:c6:ff:4e:ad:68:b4:bd:55
Signer

Actual PE Digest

0e:e5:58:31:c0:12:aa:41:07:29:30:e3:c6:ff:4e:ad:68:b4:bd:55

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Yonyou Network Technology Co.\,Ltd,O=Yonyou Network Technology Co.\,Ltd,ST=Beijing,C=CN

21/03/2023, 12:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreA

gdiplus

GdipSetStringFormatTrimming
GdipDrawLineI
GdipCreatePen1
GdipCreateHICONFromBitmap
GdipDrawEllipseI
GdipFillEllipseI
GdipCreateRegion
GdipSetClipRegion
GdipGetClip
GdipDrawEllipse
GdipDeleteRegion
GdipDeletePen
GdipDrawPath
GdipSetImageAttributesColorMatrix
GdipResetClip
GdipImageGetFrameDimensionsCount
GdipGetPropertyItem
GdipDrawImageRectI
GdipDisposeImageAttributes
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipCreateImageAttributes
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipDrawImageRectRectI
GdipGetPropertyItemSize
GdipSetPenDashStyle
GdipAddPathArcI
GdipDeletePath
GdipCreatePath
GdipFillPath
GdipAddPathLineI
GdipSetStringFormatTabStops
GdipGetFontSize
GdipCreateLineBrushFromRectI
GdipCreateStringFormat
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetStringFormatLineAlign
GdipCreateFont
GdipDrawArc
GdipCreateFromHWND
GdipGetLogFontW
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipMeasureString
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipReleaseDC
GdipSaveGraphics
GdipGetDC
GdipCreateMatrix
GdipSetSmoothingMode
GdipSetWorldTransform
GdipSetClipRectI
GdipTranslateMatrix
GdipRestoreGraphics
GdipDeleteMatrix
GdipDrawRectangleI
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipBitmapGetPixel
GdipCloneBrush
GdipFillRectangleI
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipFree
GdipGetImageHeight
GdipGetImageWidth

wininet

InternetCloseHandle
InternetConnectW
HttpQueryInfoW
HttpSendRequestW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache
HttpSendRequestExW
HttpEndRequestW
InternetReadFile
InternetCrackUrlW
InternetSetOptionW
InternetWriteFile
InternetQueryOptionW
HttpOpenRequestW
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

GetModuleHandleExA
GetModuleHandleA
ReleaseMutex
CreateMutexW
WriteConsoleW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
MoveFileExW
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
SleepConditionVariableSRW
QueryPerformanceCounter
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStdHandle
ExitProcess
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
HeapFree
InitializeCriticalSectionEx
HeapSize
GetLastError
OutputDebugStringW
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetModuleFileNameW
CreateMutexA
ProcessIdToSessionId
CloseHandle
GetCurrentProcessId
OutputDebugStringA
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetTickCount
GetCurrentProcess
LoadLibraryW
GetProcAddress
SetUnhandledExceptionFilter
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
RemoveDirectoryW
SetFileTime
GetEnvironmentVariableW
CreateFileW
SetFileAttributesW
GetFileAttributesExW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GlobalMemoryStatusEx
CopyFileW
GetModuleFileNameA
GetCurrentThreadId
Sleep
CancelIo
CreateDirectoryA
ReadFile
CreateNamedPipeA
CreateDirectoryW
SizeofResource
WriteFile
GetShortPathNameW
GetProcessId
WaitForSingleObject
FormatMessageW
LockResource
LoadResource
FindResourceW
GetFileSize
VerSetConditionMask
SystemTimeToFileTime
VerifyVersionInfoW
GetSystemTime
GetSystemInfo
GetModuleHandleW
GetUserDefaultUILanguage
GetLongPathNameW
TerminateProcess
K32GetModuleFileNameExW
OpenProcess
LoadLibraryA
K32EnumProcesses
K32EnumProcessModules
GlobalAlloc
GlobalLock
GlobalUnlock
SetEvent
ResetEvent
CreateEventA
GetExitCodeProcess
GlobalFree
lstrcpyW
CreateNamedPipeW
WaitForMultipleObjects
DisconnectNamedPipe
CreateEventW
GetOverlappedResult
ConnectNamedPipe
CreatePipe
GetVersionExW
CreateProcessW
lstrlenW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
TlsAlloc
LocalFree
TlsFree
FormatMessageA
FileTimeToSystemTime
GetFileType
GetFileInformationByHandle
GetLocalTime
SetFilePointer
FileTimeToDosDateTime
DuplicateHandle
FindFirstFileW
FindNextFileW
FindClose
DosDateTimeToFileTime
LoadLibraryExA
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
SleepEx
TlsGetValue
CreateIoCompletionPort
QueryPerformanceFrequency
WaitForSingleObjectEx
GetExitCodeThread
RegisterWaitForSingleObject
UnregisterWaitEx
GetFileAttributesW
GetNativeSystemInfo
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
LCMapStringEx
EncodePointer
CompareStringEx
GetCPInfo
GetLocaleInfoEx
GetStringTypeW
UnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlUnwind
GetNamedPipeInfo
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
SleepConditionVariableCS
IsDebuggerPresent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
GetSystemTimeAsFileTime
WakeAllConditionVariable

user32

GetDesktopWindow
ReleaseCapture
ReleaseDC
BeginPaint
EndPaint
SetTimer
ClientToScreen
PeekMessageW
KillTimer
WaitForInputIdle
OpenClipboard
SetCursor
GetWindowDC
SetCapture
LoadCursorW
TranslateAcceleratorW
GetForegroundWindow
ValidateRect
MapWindowPoints
RegisterClassW
CloseClipboard
EmptyClipboard
SetClipboardData
wsprintfW
GetMessageW
GetMonitorInfoW
ScreenToClient
PostQuitMessage
DispatchMessageW
EnumWindows
CreateWindowExW
LoadAcceleratorsW
DestroyIcon
PostMessageW
IsWindowVisible
DestroyWindow
IsIconic
MoveWindow
GetWindowThreadProcessId
ModifyMenuW
LoadMenuW
GetMenuItemID
MonitorFromWindow
GetMenuItemCount
TrackPopupMenu
GetSubMenu
LoadIconW
RemoveMenu
IsZoomed
GetCursorPos
GetWindowLongW
GetWindow
MessageBoxW
SetActiveWindow
ShowWindow
SetWindowLongA
SetFocus
SetForegroundWindow
FindWindowExW
SetWindowPos
SendMessageW
IsWindow
GetWindowLongA
SetParent
SetWindowLongW
GetClientRect
GetParent
FillRect
GetWindowRect
GetKeyState
DefWindowProcW
UpdateWindow
InvalidateRect
UnregisterClassW
IntersectRect
CopyRect
GetIconInfo
RegisterClassExW
GetWindowTextW
SetWindowTextW
GetDC
MsgWaitForMultipleObjectsEx
GetQueueStatus
WaitMessage
CallMsgFilterW
UnionRect
TranslateMessage
OffsetRect

gdi32

GetObjectW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
CreateFontW
CreateFontIndirectW
GetStockObject
DeleteObject
GetDIBits
SetViewportOrgEx
CreateSolidBrush

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW
RegEnumValueW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHChangeNotify
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW

ole32

CoInitializeEx
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize

shlwapi

PathIsDirectoryA
SHAutoComplete
StrCpyNW

ws2_32

freeaddrinfo
ioctlsocket
setsockopt
connect
gethostbyname
WSACloseEvent
WSACreateEvent
WSASetEvent
WSAStartup
inet_ntoa
gethostname
WSAGetLastError
socket
inet_addr
ntohs
htons
getpeername
getaddrinfo
WSASocketW
WSASetLastError
listen
shutdown
htonl
ntohl
select
WSASend
closesocket
WSAIoctl
bind
accept
__WSAFDIsSet
send
getsockopt
WSARecv
getsockname
WSAAddressToStringW
WSACleanup

iphlpapi

NotifyAddrChange
CancelIPChangeNotify
GetAdaptersAddresses

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 692KB - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 163KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

4d1adbd615da10f5981597929486306c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:3d:ab:af:ee:c2:b9:6b:34:c7:e3:33:c9:51:58:8cCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

0e:e5:58:31:c0:12:aa:41:07:29:30:e3:c6:ff:4e:ad:68:b4:bd:55Signer

Signature Validations

Verification

21/03/2023, 12:24 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

gdiplus

wininet

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

ws2_32

iphlpapi

winmm

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 692KB - Virtual size: 692KB

.data Size: 163KB - Virtual size: 187KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 251KB - Virtual size: 251KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:3d:ab:af:ee:c2:b9:6b:34:c7:e3:33:c9:51:58:8c
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

0e:e5:58:31:c0:12:aa:41:07:29:30:e3:c6:ff:4e:ad:68:b4:bd:55
Signer

21/03/2023, 12:24
Valid: false

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 692KB - Virtual size: 692KB

.data
Size: 163KB - Virtual size: 187KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 251KB - Virtual size: 251KB