raccoon | 2376-56-0x0000000000400000-0x0000000001B44000-memory[.]dmp

General

Target
2376-56-0x0000000000400000-0x0000000001B44000-memory.dmp
Size 23.3MB
Sample240313-sa76eshf68
SHA256 ff534ba757c496964831b6cd492f9fa856b9fc2c07460f9cf1e0da63bda9fcde
MD5 8e486c3ba8efded80537fc39d83c36b9
SHA1 bc7542a099c868601c025d9cc55ac748fdb96519
SHA512 6508c48fc918974762f4d849a773b9e6cee3f1a2ce051394261149646846c091db686858d48f9e5739800ed6db89746cab7cdbf897df338aab8de966e8da8c0b
SSDEEP 3072:YyLvAxebfMhFG8yyrHe6PKMFrXh5ibGflYkLePK0c6jM:YgvA8fcBTJy+bhaM9qK6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

385573eb8024f2ce9fbfd9c1ba5d4cd4 raccoon

Malware Config

Extracted

Family

raccoon

Botnet

385573eb8024f2ce9fbfd9c1ba5d4cd4

C2

http://5.78.65.112:8988/

Attributes

user_agent
DuckTales

xor.plain

Signatures

Raccoon Stealer V2 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v2

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2376-56-0x0000000000400000-0x0000000001B44000-memory.dmp

File Explorer

2376-56-0x0000000000400000-0x0000000001B44000-memory.dmp

.exe 23.3MB

2376-56-0x0000000000400000-0x0000000001B44000-memory.dmp

SHA256 ff534ba757c496964831b6cd492f9fa856b9fc2c07460f9cf1e0da63bda9fcde
MD5 8e486c3ba8efded80537fc39d83c36b9
SHA1 bc7542a099c868601c025d9cc55ac748fdb96519
SHA512 6508c48fc918974762f4d849a773b9e6cee3f1a2ce051394261149646846c091db686858d48f9e5739800ed6db89746cab7cdbf897df338aab8de966e8da8c0b
SSDEEP 3072:YyLvAxebfMhFG8yyrHe6PKMFrXh5ibGflYkLePK0c6jM:YgvA8fcBTJy+bhaM9qK6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V2 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing