raccoon | 2456-11-0x0000000000400000-0x0000000000416000-memory[.]dmp

General

Target
2456-11-0x0000000000400000-0x0000000000416000-memory.dmp
Size 88KB
Sample240301-dp7e4sbf87
SHA256 708adcdc95e87d79d8cf775cb6e6f0f5e9c26b66fc8b3586218e7c3baac1070c
MD5 a10e6a70510d1ab8337b72518402ff84
SHA1 0d4cf723c8118098965dbbcb9cc6060222405c15
SHA512 2f308a80420d205535d92c17e4624b2da47c17f2d5bd75b65b0c140ffaf1cf0f05a8245304a4ea71f333b2ce1324da7b7752ee982ea4fe60ece8077653830397
SSDEEP 1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3S0FqH:9PI6GWpeVsXCLMrxbQOpXFqH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

51aff6e9402ba30682487f3dfa017fcf raccoon

Malware Config

Extracted

Family

raccoon

Botnet

51aff6e9402ba30682487f3dfa017fcf

C2

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2456-11-0x0000000000400000-0x0000000000416000-memory.dmp

File Explorer

2456-11-0x0000000000400000-0x0000000000416000-memory.dmp

.exe 88KB

2456-11-0x0000000000400000-0x0000000000416000-memory.dmp

SHA256 708adcdc95e87d79d8cf775cb6e6f0f5e9c26b66fc8b3586218e7c3baac1070c
MD5 a10e6a70510d1ab8337b72518402ff84
SHA1 0d4cf723c8118098965dbbcb9cc6060222405c15
SHA512 2f308a80420d205535d92c17e4624b2da47c17f2d5bd75b65b0c140ffaf1cf0f05a8245304a4ea71f333b2ce1324da7b7752ee982ea4fe60ece8077653830397
SSDEEP 1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3S0FqH:9PI6GWpeVsXCLMrxbQOpXFqH
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing