Behavioral task
behavioral1
Sample
ba504fc71c55b7a2c381e8ba66f43bdb.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
ba504fc71c55b7a2c381e8ba66f43bdb.exe
Resource
win10v2004-20230703-en
General
-
Target
ba504fc71c55b7a2c381e8ba66f43bdb.exe
-
Size
50KB
-
MD5
ba504fc71c55b7a2c381e8ba66f43bdb
-
SHA1
3d66ba2967ea4dede13e5a8a92000aac844111d0
-
SHA256
0e9f4c905b8c70b93cc923e6c1105f67697f04f525b1cac73ec31101939018e8
-
SHA512
d17b401af92c519407c73835cbdf929c7b5619848d310acb6c0500ff2d22a9e7fd1de326dd2aa0dc7638d8712aeaed100913b26ced9daa072907ba827ed89e4d
-
SSDEEP
768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84
Malware Config
Extracted
raccoon
8c43462d3009db225c4c0889737572cd
http://94.142.138.49:80/
http://94.142.138.108:80/
Signatures
-
Raccoon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ba504fc71c55b7a2c381e8ba66f43bdb.exe
Files
-
ba504fc71c55b7a2c381e8ba66f43bdb.exe.exe windows x86
8293f3c89c8bdc2a5d082fbe7d24c76c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
lstrlenA
LocalAlloc
LoadLibraryA
ole32
CoInitialize
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE