General
-
Target
2808-134-0x0000000000400000-0x000000000040F000-memory.dmp
-
Size
60KB
-
MD5
82bb1e6c8ad05b2179207c4c4f409b44
-
SHA1
2825968c5fc17dae2a0a269b9b3f19baf05d8bc4
-
SHA256
e8e6e4ba214621f954137aedc8c47e7b60603ed379e17c785e8979e9dc02892a
-
SHA512
63b89d02a58ead10222442366aeb921346a61cb1c86532757367eeb56ed714b2a8ea4ef4324bcd44e1b2491f36f72f477436123e1ab7ddceda73f81a9e828a6e
-
SSDEEP
768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW/msk:T2t4cybq56O/4
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
e8782bb6af54a6fc803d6e28ed2282f2
C2
http://185.157.120.15:80/
Attributes
-
user_agent
DuckTales
xor.plain
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
-
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2808-134-0x0000000000400000-0x000000000040F000-memory.dmp
Headers
Sections