raccoon | 2024-09-06_643026541720972204662503b2c484d0_avoslocker_cobalt-strike_raccoonstealer

Sharing

Copy URL Twitter E-mail

General

Target
2024-09-06_643026541720972204662503b2c484d0_avoslocker_cobalt-strike_raccoonstealer
Size 564KB
Sample240906-c3vssssarc
SHA256 ff41cbd224f2e3fdb7c97f6a7ffcd0b86026bab9d790534a76e5e6f094ff66ed
MD5 643026541720972204662503b2c484d0
SHA1 3c9ad45c4377e658b1ac58c729d7f9c2bc400e2b
SHA512 af91ee36da1401e1b451ec31015cc70e2c1c40d5dd7a2d1bc582b8839d46cc629739089c5f72ee19570ff86647ff8c16cfa38b504edd00f8ad42b611c2288735
SSDEEP 12288:38Malpp/QPcqcGVwwAPfoEQB94Uc1VNzZWPx9YBKFTdb:38dhQEqcGQfoxGVxIPAINd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon

Malware Config

Signatures

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
sample	family_raccoon_v1

Raccoon family
raccoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-06_643026541720972204662503b2c484d0_avoslocker_cobalt-strike_raccoonstealer

File Explorer

2024-09-06_643026541720972204662503b2c484d0_avoslocker_cobalt-strike_raccoonstealer

.exe 564KB

2024-09-06_643026541720972204662503b2c484d0_avoslocker_cobalt-strike_raccoonstealer

IMPHASH 2f1bba23d3f31d886fd20c963bc55038
SHA256 ff41cbd224f2e3fdb7c97f6a7ffcd0b86026bab9d790534a76e5e6f094ff66ed
MD5 643026541720972204662503b2c484d0
SHA1 3c9ad45c4377e658b1ac58c729d7f9c2bc400e2b
SHA512 af91ee36da1401e1b451ec31015cc70e2c1c40d5dd7a2d1bc582b8839d46cc629739089c5f72ee19570ff86647ff8c16cfa38b504edd00f8ad42b611c2288735
SSDEEP 12288:38Malpp/QPcqcGVwwAPfoEQB94Uc1VNzZWPx9YBKFTdb:38dhQEqcGQfoxGVxIPAINd
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Raccoon Stealer V1 payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

256446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject GetModuleHandleA GetLocaleInfoA Sleep RemoveDirectoryTransactedA GetUserDefaultLCID CreateThread GetLastError DeleteFileA HeapAlloc lstrcpynA lstrcmpiW GetModuleFileNameA GetCurrentProcess GetSystemPowerStatus CreateMutexA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetSystemWow64DirectoryW GetTimeZoneInformation OpenMutexA Process32NextW GlobalAlloc GetEnvironmentVariableA Process32FirstW GlobalFree GetSystemInfo GetLogicalDriveStringsA GlobalMemoryStatusEx WideCharToMultiByte CreateProcessA GetComputerNameA UnmapViewOfFile GetFileInformationByHandle CreateFileA GetLocalTime CreateFileMappingA MapViewOfFile GetTickCount SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc OutputDebugStringW lstrlenA GetFileSize lstrcpyW lstrcatW GetVersionExW CreateDirectoryA SystemTimeToFileTime lstrcpyA CloseHandle GetFileAttributesA LocalFileTimeToFileTime SetCurrentDirectoryA GetCurrentDirectoryA SetFilePointer SetFileTime WriteFile ReadFile FindClose GetDriveTypeA CopyFileTransactedA lstrlenW FreeLibrary GetProcessHeap LocalFree GetProcAddress LoadLibraryA LocalAlloc DeleteFileTransactedA SetEnvironmentVariableW ReadConsoleW EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileSizeEx HeapSize GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW HeapFree FileTimeToSystemTime CreateDirectoryTransactedA ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind TerminateProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetStringTypeW SetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI DeviceIoControl CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx

user32

wsprintfA GetWindowDC GetWindowRect GetSystemMetrics GetDesktopWindow EnumDisplayDevicesA wsprintfW

gdi32

BitBlt SaveDC SelectObject CreateDIBSection CreateCompatibleDC GetDeviceCaps DeleteDC RestoreDC DeleteObject

advapi32

GetTokenInformation CryptGetHashParam CryptDestroyHash RegQueryValueExA GetUserNameA CreateProcessWithTokenW OpenProcessToken RegOpenKeyExA ConvertSidToStringSidW DuplicateTokenEx RegQueryValueExW CryptReleaseContext RegCloseKey RegEnumKeyExW RegOpenKeyExW CryptAcquireContextA CredEnumerateW CredFree CryptCreateHash CryptHashData

shell32

SHGetFolderPathA ShellExecuteA SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

userenv

GetUserProfileDirectoryA

ktmw32

CreateTransaction RollbackTransaction CommitTransaction

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

crypt32

CryptStringToBinaryA CryptUnprotectData

shlwapi

StrCmpNW PathCombineW StrStrIW StrToIntA

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpOpen WinHttpCloseHandle WinHttpReceiveResponse WinHttpReadData

gdiplus

GdiplusStartup GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipSaveImageToFile