raccoon | 6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f

Sharing

Copy URL Twitter E-mail

General

Target
6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f
Size 9.4MB
Sample231022-d7284sfa29
SHA256 6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f
MD5 c86689523095e471f80c8a849168313a
SHA1 119d14c521ee91677a19b4d212b07eced5e9763a
SHA512 f9b52493ba84569d67fca4a89e85491e999c7dc60edbb284b50dfc76bfb07b18121737c7544e3f63669c724d42817072528ff5e012de4e5ea33976d86948bc92
SSDEEP 196608:Xa+pGyTalKSD74X8O7qXw9aO9Vkq6e95RVQiWwy8kmzmrrePTiWJZ9oTO99EkE:q+Ay0D7mRqXlWVue9LmiKszNWWxo60
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1737eb774d349e08c3b8398927baa0aa raccoon

Malware Config

Extracted

Family

raccoon

Botnet

1737eb774d349e08c3b8398927baa0aa

http://94.142.138.114:80/

Attributes

user_agent
SunShineMoonLight

xor.plain

Signatures

Raccoon Stealer payload 1 IoCs

resource	yara_rule
sample	family_raccoon

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f

File Explorer

6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f

.exe 9.4MB

6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f

IMPHASH 2efc5f42facb048a736c94c651f55845
SHA256 6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f
MD5 c86689523095e471f80c8a849168313a
SHA1 119d14c521ee91677a19b4d212b07eced5e9763a
SHA512 f9b52493ba84569d67fca4a89e85491e999c7dc60edbb284b50dfc76bfb07b18121737c7544e3f63669c724d42817072528ff5e012de4e5ea33976d86948bc92
SSDEEP 196608:Xa+pGyTalKSD74X8O7qXw9aO9Vkq6e95RVQiWwy8kmzmrrePTiWJZ9oTO99EkE:q+Ay0D7mRqXlWVue9LmiKszNWWxo60
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Raccoon Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OutputDebugStringA FindClose CreateMutexA LocalAlloc ReleaseMutex CancelWaitableTimer GetLastError SetEvent LoadLibraryA ReleaseSemaphore LoadLibraryW ResetEvent CreateWaitableTimerA GetProcAddress LocalFree SetEnvironmentVariableA CreateFileMappingW CreateSemaphoreA CreateEventA lstrlenA CloseHandle FindFirstFileA GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery

advapi32

RegOpenKeyExA

ole32

CoInitialize

user32

CharUpperBuffW

Name

.text

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp|<|>

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp|<|>

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp|<|>

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l1

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

6faa54734baa6510aeab6ff133514bd4a49810de298ca9a8fb3a783ab48aef5f

kernel32

advapi32

ole32

user32

generic