Overview

overview

10

Static

static

10

628-82-0x0...ry.exe

windows7-x64

1

628-82-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    628-82-0x0000000000400000-0x000000000047B000-memory.dmp

  • Size

    492KB

  • MD5

    446a9ed4d6348872ac9d16f4e0e41ccd

  • SHA1

    48943370c22b425276473e0e41eeb2362b5a051c

  • SHA256

    e52ee75ba8f58213d685aad0aeff6117c1d324523a90cc21b700f385f3bf0485

  • SHA512

    3646a69aab2332d9b71e725a23ff1d75cf8035702eb9f4acd0516555e0f442618152d5d50d595ce15d4c6600e4298e00ba1dc0e0d25619a84901e608c130548d

  • SSDEEP

    3072:J5HqXHmQESDeGF+hNnbP1vumSrUDTX3rzgsL0A1lr:JBuHZDINxIYx

Score
10/10
f80018d0f7c5463eabb5c698eb201532raccoon

Malware Config

Extracted

Family

raccoon

Botnet

f80018d0f7c5463eabb5c698eb201532

C2

http://5.42.65.18:80/

http://5.42.64.13:80/

http://5.42.65.17:80/

http://5.42.65.12:80/
Attributes
  • user_agent

    GunnaWunnaBlueTips

xor.plain

Signatures

  • Raccoon Stealer V2 payload 1 IoCs
  • Raccoon family
    raccoon
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 628-82-0x0000000000400000-0x000000000047B000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections