raccoon | 2111exe[.]exe | Triage

Sharing

General

Target

2111exe.exe
Size

50KB
MD5

0d0d1b6f1817ccd05bf4ad2019b1b180
SHA1

e424559ac98512188ba7dbb7163f014412a2d2cf
SHA256

86dd8a1c28ec1c709456e6a25a6038cc8f113d1de22d99e8e2dfaf0a5dcdb6a6
SHA512

fe5abd004d04f082c2a4521d3d5a05005d2f592aaacb0d50d519c5e080efdc9b3bf25557e7f1a7f2712a04d51b76bc383ef593b84a4f9649ce765c4628a81fd1
SSDEEP

768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84

Score

10^/10

raccoon

Malware Config

Signatures

Raccoon Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_raccoon
Raccoon family
raccoon
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

2111exe.exe

Files

2111exe.exe
.exe windows x86

8293f3c89c8bdc2a5d082fbe7d24c76c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
lstrlenA
LocalAlloc
LoadLibraryA

ole32

CoInitialize

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE