raccoon | 1436-135-0x0000000000400000-0x0000000001A91000-memory[.]dmp

General

Target
1436-135-0x0000000000400000-0x0000000001A91000-memory.dmp
Size 22.6MB
Sample240302-jsz34abf5x
SHA256 06e069ce03895cd0d29b49226def72bc22ad0760708a593e091a21f9ac6af638
MD5 ae75bab99c44bb4e3f06ca87c76e58da
SHA1 4d4dded898e41b06b122a2e17bbcaeab5c68cf85
SHA512 b354ac3cbaa3707f631573d51bce2c04c3e0fb366f11700f42ffeed93e1c3fcc73f1632a8a4ff60a4b643ff1819b9b77299b787362bee934a7e73c4356c479db
SSDEEP 393216:xMv2jh9vylEeNEjEnbB6wlz9PlP79sKqK25Pw69pKk:82jrvikEnLl5PnD2dFpK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

334fd5a216b2c3b3e5a3fb91bcdf6c9c raccoon

Malware Config

Extracted

Family

raccoon

Botnet

334fd5a216b2c3b3e5a3fb91bcdf6c9c

C2

http://94.142.138.123
http://94.142.138.124

Attributes

user_agent
901785252112

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1436-135-0x0000000000400000-0x0000000001A91000-memory.dmp

File Explorer

1436-135-0x0000000000400000-0x0000000001A91000-memory.dmp

.exe 22.6MB

1436-135-0x0000000000400000-0x0000000001A91000-memory.dmp

SHA256 06e069ce03895cd0d29b49226def72bc22ad0760708a593e091a21f9ac6af638
MD5 ae75bab99c44bb4e3f06ca87c76e58da
SHA1 4d4dded898e41b06b122a2e17bbcaeab5c68cf85
SHA512 b354ac3cbaa3707f631573d51bce2c04c3e0fb366f11700f42ffeed93e1c3fcc73f1632a8a4ff60a4b643ff1819b9b77299b787362bee934a7e73c4356c479db
SSDEEP 393216:xMv2jh9vylEeNEjEnbB6wlz9PlP79sKqK25Pw69pKk:82jrvikEnLl5PnD2dFpK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12364321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.*^$

Size

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.i-#

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ZV&

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

464KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1436-135-0x0000000000400000-0x0000000001A91000-memory.dmp

generic