General

  • Target

    51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5

  • Size

    80KB

  • MD5

    f82ea9c268d7a1f870ab9c21bae7bc95

  • SHA1

    0ab17037e1a5965ec2675f9706b815a8fef065b4

  • SHA256

    51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5

  • SHA512

    e135307fabdf44e5456dc58bd5803fe8de7d81920e80efb848ae72bd28a3deed0cd199d77daa24ff52761eaba08186904da0442a1f3aaa81c58a8847c893ac32

  • SSDEEP

    1536:KX0PI6ORWFPekAZZ0XCkSBIPV1Fn1p06QcKUp3vFqH:9PI6GWpeVsXCLMrxbQOp/FqH

Malware Config

Extracted

Family

raccoon

Botnet

c9a292c7f35baf6617c47609806a2935

C2

http://95.169.205.186:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Signatures

  • Raccoon Stealer V2 payload 1 IoCs
  • Raccoon family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 51519b1ecbe61679a87287a7ec43da51927b584191afbcc7ea7696c09f6f57b5
    .exe windows:6 windows x86 arch:x86

    52fcc5c1bcda70fa4759c08995c5a5fb


    Headers

    Imports

    Sections