raccoon | dbe7eccbff00597b8df49be033b0bcc10bc602771382c[.]exe | Triage

Sharing

General

Target

dbe7eccbff00597b8df49be033b0bcc10bc602771382c.exe
Size

97KB
MD5

92434b38cef64589149fb102f5cf94ae
SHA1

40000a8e8295d9c1f1484572728fa9b182cec458
SHA256

dbe7eccbff00597b8df49be033b0bcc10bc602771382ca8d3c5ab998762a4cf1
SHA512

8b2a9b7d40ada3dc61862fb935f28ec85f63ea7d252c3ed0465b44315638fc33984c9df81829582328359ff38b0432c0a3daa88e96711aca1f60ee70eaafd3f9
SSDEEP

3072:yEfIr0usN5rtB+U7ITo+StATE9DFDYpcO:yyttI0PtZ9p

Score

10^/10

raccoon

Malware Config

Signatures

Raccoon Stealer payload 1 IoCs

resource	yara_rule
sample	family_raccoon

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbe7eccbff00597b8df49be033b0bcc10bc602771382c.exe

Files

dbe7eccbff00597b8df49be033b0bcc10bc602771382c.exe
.exe windows x86

0fcb7632c48018563e5af2f63681ece5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
FindClose
CreateMutexA
LocalAlloc
ReleaseMutex
CancelWaitableTimer
GetLastError
SetEvent
LoadLibraryA
ReleaseSemaphore
LoadLibraryW
ResetEvent
CreateWaitableTimerA
GetProcAddress
LocalFree
SetEnvironmentVariableA
CreateFileMappingW
CreateSemaphoreA
CreateEventA
lstrlenA
CloseHandle
FindFirstFileA

advapi32

RegOpenKeyExA

ole32

CoInitialize

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE