Behavioral task
behavioral1
Sample
51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5.exe
Resource
win10v2004-20240802-en
General
-
Target
51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5
-
Size
80KB
-
MD5
f82ea9c268d7a1f870ab9c21bae7bc95
-
SHA1
0ab17037e1a5965ec2675f9706b815a8fef065b4
-
SHA256
51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5
-
SHA512
e135307fabdf44e5456dc58bd5803fe8de7d81920e80efb848ae72bd28a3deed0cd199d77daa24ff52761eaba08186904da0442a1f3aaa81c58a8847c893ac32
-
SSDEEP
1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3vFqH:9PI6GWpeVsXCLMrxbQOp/FqH
Malware Config
Extracted
raccoon
c9a292c7f35baf6617c47609806a2935
http://95.169.205.186:80/
-
user_agent
MrBidenNeverKnow
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
resource yara_rule sample family_raccoon_v2 -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5
Files
-
51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5.exe windows:6 windows x86 arch:x86
52fcc5c1bcda70fa4759c08995c5a5fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
ReleaseSemaphore
OutputDebugStringA
FindClose
CreateMutexA
LocalAlloc
ReleaseMutex
CancelWaitableTimer
GetLastError
GetProcAddress
CloseHandle
ResetEvent
CreateWaitableTimerA
LocalFree
SetEnvironmentVariableA
CreateFileMappingW
CreateSemaphoreA
CreateEventA
lstrlenA
SetEvent
LoadLibraryA
advapi32
RegOpenKeyExA
ole32
CoInitialize
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE