Behavioral task
behavioral1
Sample
c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb.exe
Resource
win10v2004-20231020-en
General
-
Target
c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb
-
Size
81KB
-
MD5
2ee11cec1aada0b6967ac085a7c9899b
-
SHA1
41f55e5332de55f0542e615b5ef9ace172339625
-
SHA256
c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb
-
SHA512
449dddd2e934f234b8906daa2794479e1b482348cde48b82035bd364ed4d0ccbf0bdae555443b4f3378173c28a0e5384b621f2e5cc09ffb75491f827c60cb695
-
SSDEEP
1536:WRLNQIfcBuof7xJPYuPfwO3dL7C5aq5v+E/LtRWIOQA3zMo7BlQdH:KLN3Iuof7TY44O3dL71KRRzOvjfsdH
Malware Config
Signatures
-
Raccoon Stealer payload 1 IoCs
resource yara_rule sample family_raccoon -
Raccoon family
-
Find unpacked information stealer based on possible SQL query to retrieve broswer data 1 IoCs
Detects infostealer.
resource yara_rule sample infostealer_generic_browser_sql -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb
Files
-
c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb.exe windows:6 windows x86
52fcc5c1bcda70fa4759c08995c5a5fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
ReleaseSemaphore
OutputDebugStringA
FindClose
CreateMutexA
LocalAlloc
ReleaseMutex
CancelWaitableTimer
GetLastError
GetProcAddress
CloseHandle
ResetEvent
CreateWaitableTimerA
LocalFree
SetEnvironmentVariableA
CreateFileMappingW
CreateSemaphoreA
CreateEventA
lstrlenA
SetEvent
LoadLibraryA
advapi32
RegOpenKeyExA
ole32
CoInitialize
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE