Behavioral task
behavioral1
Sample
175ac1e037521a1d29bffe5abe0d9d92.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
175ac1e037521a1d29bffe5abe0d9d92.exe
Resource
win10v2004-20230621-en
General
-
Target
175ac1e037521a1d29bffe5abe0d9d92
-
Size
50KB
-
MD5
175ac1e037521a1d29bffe5abe0d9d92
-
SHA1
4a1f499e862abb46bd9f3e21f80186704e441df5
-
SHA256
5ff52ab9349cd6d7a7fc0d2596c3423cdfb5df668b363fb93bd686f9ab198910
-
SHA512
c2bfdb5b038b577a4a1b06e7cdf4d0215448591ccabeb98531bb7fd03dac569a99fa8ed056b8b1df4bc45b0293d0746ef0b94028844cb0a59724e9ca8d29ad67
-
SSDEEP
768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84
Malware Config
Extracted
raccoon
6ef182aaa19660fad619838fa9b3b098
http://89.208.107.176:80
Signatures
-
Raccoon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 175ac1e037521a1d29bffe5abe0d9d92
Files
-
175ac1e037521a1d29bffe5abe0d9d92.exe windows x86
8293f3c89c8bdc2a5d082fbe7d24c76c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
lstrlenA
LocalAlloc
LoadLibraryA
ole32
CoInitialize
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE