raccoon | dc819e6f51c7f362067711fb89fc1eaa

Sharing

Copy URL Twitter E-mail

General

Target
dc819e6f51c7f362067711fb89fc1eaa
Size 583KB
Sample240321-yv94eaha76
SHA256 1c474449c67becb01f8689bd34ba10ee57b0ff2688592ea87be2368474af819e
MD5 dc819e6f51c7f362067711fb89fc1eaa
SHA1 bc7c47eba8bc19772c9218607cdd4faf760f56cc
SHA512 617031694a3e61accb676592ac85077e6a137e19955bd9419de14fcfc4e0ef69786ea62aa7b72db2ab7b7d04187436b7263d864ce2d9b0f22859012658db4c33
SSDEEP 12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFh3GacOB8/e:7IXbzHMBhxbhrVeOlflon/e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aae14d50147481e9d32954bcc9a2bea8730e3959 raccoon

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

aae14d50147481e9d32954bcc9a2bea8730e3959

Attributes

url4cnc
https://telete.in/ponnilowercase

rc4.plain

Signatures

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v1

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc819e6f51c7f362067711fb89fc1eaa

File Explorer

dc819e6f51c7f362067711fb89fc1eaa

.exe 583KB

dc819e6f51c7f362067711fb89fc1eaa

IMPHASH 5bccc4ddaaaa65b3c4a43f5df51c1a02
SHA256 1c474449c67becb01f8689bd34ba10ee57b0ff2688592ea87be2368474af819e
MD5 dc819e6f51c7f362067711fb89fc1eaa
SHA1 bc7c47eba8bc19772c9218607cdd4faf760f56cc
SHA512 617031694a3e61accb676592ac85077e6a137e19955bd9419de14fcfc4e0ef69786ea62aa7b72db2ab7b7d04187436b7263d864ce2d9b0f22859012658db4c33
SSDEEP 12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFh3GacOB8/e:7IXbzHMBhxbhrVeOlflon/e
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V1 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

262207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject GetModuleHandleA GetLocaleInfoA Sleep RemoveDirectoryTransactedA GetUserDefaultLCID CreateThread GetLastError DeleteFileA HeapAlloc lstrcpynA lstrcmpiW GetModuleFileNameA GetCurrentProcess GetSystemPowerStatus CreateMutexA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetSystemWow64DirectoryW GetTimeZoneInformation OpenMutexA Process32NextW GlobalAlloc GetEnvironmentVariableA Process32FirstW GlobalFree GetSystemInfo GetLogicalDriveStringsA GlobalMemoryStatusEx WideCharToMultiByte CreateProcessA GetComputerNameA UnmapViewOfFile GetFileInformationByHandle CreateFileA GetLocalTime CreateFileMappingA MapViewOfFile GetTickCount SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc OutputDebugStringW lstrlenA GetFileSize lstrcpyW GetVersionExW lstrlenW CreateDirectoryA SystemTimeToFileTime lstrcpyA CloseHandle GetFileAttributesA LocalFileTimeToFileTime SetCurrentDirectoryA GetCurrentDirectoryA SetFilePointer SetFileTime WriteFile ReadFile FindClose GetDriveTypeA CopyFileTransactedA FreeLibrary GetProcessHeap LocalFree GetProcAddress lstrcatW LoadLibraryA LocalAlloc DeleteFileTransactedA SetEnvironmentVariableW ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileSizeEx HeapSize GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW HeapFree FileTimeToSystemTime CreateDirectoryTransactedA RaiseException RtlUnwind TerminateProcess InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI SetLastError DeviceIoControl GetModuleHandleW CopyFileW CreateHardLinkW FormatMessageA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount

user32

GetDesktopWindow wsprintfW wsprintfA GetSystemMetrics EnumDisplayDevicesA GetWindowDC GetWindowRect

gdi32

BitBlt SaveDC SelectObject CreateDIBSection CreateCompatibleDC GetDeviceCaps DeleteDC RestoreDC DeleteObject

advapi32

GetTokenInformation CryptGetHashParam CryptDestroyHash RegQueryValueExA GetUserNameA CreateProcessWithTokenW OpenProcessToken RegOpenKeyExA ConvertSidToStringSidW DuplicateTokenEx RegQueryValueExW CryptReleaseContext RegCloseKey RegEnumKeyExW RegOpenKeyExW CryptAcquireContextA CredEnumerateW CredFree CryptCreateHash CryptHashData

shell32

SHGetFolderPathA ShellExecuteA SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

userenv

GetUserProfileDirectoryA

ktmw32

RollbackTransaction CreateTransaction CommitTransaction

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider

crypt32

CryptStringToBinaryA CryptUnprotectData

shlwapi

StrCmpNW StrStrIW

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData

gdiplus

GdiplusStartup GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipSaveImageToFile