raccoon | 1348-141-0x0000000000400000-0x000000000100C000-memory[.]dmp

General

Target
1348-141-0x0000000000400000-0x000000000100C000-memory.dmp
Size 12.0MB
Sample240301-rxam1agg4x
SHA256 edcdfa38ec0218ac8e8ea609af38268acee06f70cc406d6d0a645c300dfc5944
MD5 7431e1fe5f1478a4c6a3e2a1db089f7e
SHA1 d2ad8a7c2ab83deca3c83d20a990be4c14c1c8ba
SHA512 01b99dda5bdd281a81cdf673c245ce83fa58e600a8db46bdcbe6a43e289ab8761c2a18535f46a9d3fef77d78d65d6aaa3485c513dae8c1a216b2f9f2bec6bc0a
SSDEEP 393216:aigO++YEdak6h8edpjc7M4h92aGBiIsbOV:xgOqEok7ed5oM4bxn6V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

b6d99cc0cf48e73c8943e8720356f837 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

b6d99cc0cf48e73c8943e8720356f837

C2

http://83.217.11.34
http://83.217.11.35

Attributes

user_agent
901785252112

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1348-141-0x0000000000400000-0x000000000100C000-memory.dmp

File Explorer

1348-141-0x0000000000400000-0x000000000100C000-memory.dmp

.exe 12.0MB

1348-141-0x0000000000400000-0x000000000100C000-memory.dmp

SHA256 edcdfa38ec0218ac8e8ea609af38268acee06f70cc406d6d0a645c300dfc5944
MD5 7431e1fe5f1478a4c6a3e2a1db089f7e
SHA1 d2ad8a7c2ab83deca3c83d20a990be4c14c1c8ba
SHA512 01b99dda5bdd281a81cdf673c245ce83fa58e600a8db46bdcbe6a43e289ab8761c2a18535f46a9d3fef77d78d65d6aaa3485c513dae8c1a216b2f9f2bec6bc0a
SSDEEP 393216:aigO++YEdak6h8edpjc7M4h92aGBiIsbOV:xgOqEok7ed5oM4bxn6V
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6287648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Az/

Size

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

._K<

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.=vh

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1348-141-0x0000000000400000-0x000000000100C000-memory.dmp

generic