Behavioral task
behavioral1
Sample
cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe
Resource
win7-20230831-en
Errors
General
-
Target
cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe.zip
-
Size
3.5MB
-
MD5
97e3115aa9a8d196b3f2a557e03a5575
-
SHA1
c4e4d7077106c940f6eeb188d4c03ecd9a4a9d44
-
SHA256
eb7ac5c22d0a393c9d776cdd86b2ac91e96a714256a6a5a6cca1256d65a549da
-
SHA512
c503cf1329de77085bc7af85e92cff1b1e0e343719f5c9a73fad3364e14fe6f80736d8cc2b6c329e8b0efb422c6b2df9e62541b13e9c82d3aeaf397b8d593637
-
SSDEEP
98304:MA1BtYbWe3RlGZbeQESv/GCchOueKSAiHHbD04mwem:T1BtzGO8QdyEu+AiH7Dtm0
Malware Config
Signatures
-
Raccoon Stealer payload 1 IoCs
resource yara_rule static1/unpack001/cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe family_raccoon -
Raccoon family
-
resource yara_rule static1/unpack001/cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe
Files
-
cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe.zip.zip
Password: infected
-
cb12b26a8d450e3f20955430b9aff68f30bcb845065660fb51eee4cf42b92b00.exe.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 260KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE