General

  • Target

    2044-56-0x0000000000400000-0x0000000002AF9000-memory.dmp

  • Size

    39.0MB

  • MD5

    6713eeabe6f984ee2989f4e6d07c0d80

  • SHA1

    d9435f94b935cf07896990d866283f0f0006778d

  • SHA256

    3014b6d35097744f5d259030bbe31ef7cd6c2b1076eed54996e601a544a0fe44

  • SHA512

    ea8877150693ed3f759caa34b32f3bc1b50f3aa8f0a366cdeee961b72b8e1d0e4a90a1bc49a0ce1faf02c753818c42d986f24c957ae675969be97da1efac1266

  • SSDEEP

    3072:/jYPQRQmr8YLNL6dzjPAvZjy8gdDKH1LRA5Fuf0JhRrb:/KWtLN+z0jDE+HMguh

Malware Config

Extracted

Family

raccoon

Botnet

31f1dd78cfcb010a34ba4139e2e6892e

C2

http://45.144.31.31/

http://195.133.40.111/

Attributes
  • user_agent

    B1D3N_RIM_MY_ASS

xor.plain

Signatures

  • Raccoon Stealer V2 payload 1 IoCs
  • Raccoon family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2044-56-0x0000000000400000-0x0000000002AF9000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections