raccoon | 1224-60-0x0000000000400000-0x0000000001DFB000-memory[.]dmp

General

Target
1224-60-0x0000000000400000-0x0000000001DFB000-memory.dmp
Size 26.0MB
Sample240305-v5p97sdd95
SHA256 95db15778986957a85fa9b4367618e511afa0dbc5bf3b39c43f83e070686cf57
MD5 25e1529659f43c81c6ada151d30f2324
SHA1 2584bd8a073179cbf870048707f68736b6f57915
SHA512 08b2f831f767a51a8335692cd58457a818ebe192a4d7fa64651844810d3e2e6e0521d5c1f3d11b35281aa61972601f49a4dc96eecbdce48723d51b085bbd085a
SSDEEP 393216:3zpwApdaxmMwW1ax8NUgudzRZCom5bUbMEtLjwQOhwLXacTOaZvDaY9j2/cVzxg:j3d2kW1aXgudzG5bmvwT8qcmY96sxg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

3b164269f2adf6743049d522e1af1845 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

3b164269f2adf6743049d522e1af1845

C2

http://83.217.11.36/
http://83.217.11.25/

Attributes

user_agent
AYAYAYAY1337

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1224-60-0x0000000000400000-0x0000000001DFB000-memory.dmp

File Explorer

1224-60-0x0000000000400000-0x0000000001DFB000-memory.dmp

.exe 26.0MB

1224-60-0x0000000000400000-0x0000000001DFB000-memory.dmp

SHA256 95db15778986957a85fa9b4367618e511afa0dbc5bf3b39c43f83e070686cf57
MD5 25e1529659f43c81c6ada151d30f2324
SHA1 2584bd8a073179cbf870048707f68736b6f57915
SHA512 08b2f831f767a51a8335692cd58457a818ebe192a4d7fa64651844810d3e2e6e0521d5c1f3d11b35281aa61972601f49a4dc96eecbdce48723d51b085bbd085a
SSDEEP 393216:3zpwApdaxmMwW1ax8NUgudzRZCom5bUbMEtLjwQOhwLXacTOaZvDaY9j2/cVzxg:j3d2kW1aXgudzG5bmvwT8qcmY96sxg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24828285

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.`J]

Size

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.g)r

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.J`R

Size

14.0MB

Virtual Size

14.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

305KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1224-60-0x0000000000400000-0x0000000001DFB000-memory.dmp

generic