Overview

overview

10

Static

static

10

0123b26df3...09.exe

windows10-2004-x64

3

022432f770...03.exe

windows10-2004-x64

3

048c011323...59.exe

windows10-2004-x64

3

0c722728ca...56.exe

windows10-2004-x64

3

2106b6f94c...fc.exe

windows10-2004-x64

3

263c18c860...93.exe

windows10-2004-x64

3

27e02b9737...77.exe

windows10-2004-x64

3

2911be45ad...7e.exe

windows10-2004-x64

10

47f3c8bf33...b1.exe

windows10-2004-x64

3

516c81438a...4e.exe

windows10-2004-x64

3

5d66919291...99.exe

windows10-2004-x64

3

6204957505...75.exe

windows10-2004-x64

3

7299026b22...69.exe

windows10-2004-x64

3

7322fbc16e...b0.exe

windows10-2004-x64

3

960ce3cc26...63.exe

windows10-2004-x64

3

99f510990f...ac.exe

windows10-2004-x64

3

9ee50e94a7...42.exe

windows10-2004-x64

bd8c106856...9e.exe

windows10-2004-x64

3

c6e6698065...9a.exe

windows10-2004-x64

10

e309a7a942...f5.exe

windows10-2004-x64

3

f7b1aaae01...27.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Raccoon.Stealer.v2.sha.zip

  • Size

    589KB

  • MD5

    0831d0df9d7696f6aed73600539cdb3f

  • SHA1

    a36cc1fde961edc0de12a70235517fcb9d8fe930

  • SHA256

    2b574142c27e20f6fd8a1285772104c9e13774631d3173f2eb825dae4a6ffe65

  • SHA512

    8618a315967c12116503a711030c6c3c1d6207b6ce121865944202556a1ea3ed7eca31fdf0b6f91193c38e352ad165b9a767514535c59a18cf056cf0472cd995

  • SSDEEP

    12288:3T0zBDiyKxxceujRPQFW0WuKDHI9yWAryOMIAxQ2UvO5v6xATr0xEQB:oRiyKL4jR4c0oYFOMrUvOZV0xP

Score
10/10
403f7b121a3afd9e8d27f945140b8a9259c9737264c0b3209d9193b8ded6c127e2586fb50f7434bfb05d10accaefc49b3ed895c4ff5dc5ec85caa2a9d1bed0f25f3e2ed386ddeccffbb4e34c56fc2efde585741d6b0b8a4e8192f16d8039618c493cd800ef7e79f58f8ff5358ddf39e3b695af1820665d4dec830ca4a9dcca08501a1e4179cf717ac47928b0babb659be659c40e6a0038a59a752ff4d0ceb719251130064569c4e8c0c5b31929396cc7fb389acc0c06486bd2eaf61e0a781e10918c80e5f68acd2d6e7bb4b7d37a91903ae13dbd91e0fa85463715dc48979fb28dfaf19d5f208c09ef40073e938545f5b9418e8977fce1050745c6371e5d9b890d78fe0763f83f0ac733762de262c55677975b9923aa5e257840086ae38f4f7ce2ae951b7762cdae39d49918c5b3283draccoon

Malware Config

Extracted

Family

raccoon

Botnet

403f7b121a3afd9e8d27f945140b8a92

C2

http://2.58.56.247

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

59c9737264c0b3209d9193b8ded6c127

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

e2586fb50f7434bfb05d10accaefc49b

C2

http://194.156.98.151

http://178.128.94.180
Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

3ed895c4ff5dc5ec85caa2a9d1bed0f2

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5f3e2ed386ddeccffbb4e34c56fc2efd

C2

http://192.248.184.34/

http://140.82.52.55/
Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

e585741d6b0b8a4e8192f16d8039618c

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

493cd800ef7e79f58f8ff5358ddf39e3

C2

http://85.202.169.112/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

b695af1820665d4dec830ca4a9dcca08

C2

http://91.194.11.43/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

501a1e4179cf717ac47928b0babb659b

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

e659c40e6a0038a59a752ff4d0ceb719

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

251130064569c4e8c0c5b31929396cc7

C2

http://142.132.180.233/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

fb389acc0c06486bd2eaf61e0a781e10

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

918c80e5f68acd2d6e7bb4b7d37a9190

C2

http://185.225.19.198/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

3ae13dbd91e0fa85463715dc48979fb2

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dfaf19d5f208c09ef40073e938545f5

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

b9418e8977fce1050745c6371e5d9b89

C2

http://51.195.166.184/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

0d78fe0763f83f0ac733762de262c556

C2

http://142.132.225.253/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

77975b9923aa5e257840086ae38f4f7c

C2

http://31.13.195.44

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

e2ae951b7762cdae39d49918c5b3283d

C2

http://51.195.166.201/

Attributes
  • user_agent

    record

rc4.plain
rc4.plain

Signatures

  • Raccoon family
    raccoon
  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

Files

  • Raccoon.Stealer.v2.sha.zip
    .zip

    Password: infected

  • 0123b26df3c79bac0a3fda79072e36c159cfd1824ae3fd4b7f9dea9bda9c7909
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 048c0113233ddc1250c269c74c9c9b8e9ad3e4dae3533ff0412d02b06bdf4059
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 0c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 2106b6f94cebb55b1d55eb4b91fa83aef051c8866c54bb75ea4fd304711c4dfc
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 263c18c86071d085c69f2096460c6b418ae414d3ea92c0c2e75ef7cb47bbe693
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 27e02b973771d43531c97eb5d3fb662f9247e85c4135fe4c030587a8dea72577
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 2911be45ad496dd1945f95c47b7f7738ad03849329fcec9c464dfaeb5081f67e
    .exe windows:6 windows x86 arch:x86

    Password: infected

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 516c81438ac269de2b632fb1c59f4e36c3d714e0929a969ec971430d2d63ac4e
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 5d66919291b68ab8563deedf8d5575fd91460d1adfbd12dba292262a764a5c99
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 62049575053b432e93b176da7afcbe49387111b3a3d927b06c5b251ea82e5975
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 7299026b22e61b0f9765eb63e42253f7e5d6ec4657008ea60aad220bbc7e2269
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 7322fbc16e20a7ef2a3188638014a053c6948d9e34ecd42cb9771bdcd0f82db0
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 960ce3cc26c8313b0fe41197e2aff5533f5f3efb1ba2970190779bc9a07bea63
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 99f510990f240215e24ef4dd1d22d485bf8c79f8ef3e963c4787a8eb6bf0b9ac
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • 9ee50e94a731872a74f47780317850ae2b9fae9d6c53a957ed7187173feb4f42
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • bd8c1068561d366831e5712c2d58aecb21e2dbc2ae7c76102da6b00ea15e259e
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • c6e669806594be6ab9b46434f196a61418484ba1eda3496789840bec0dff119a
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • e309a7a942d390801e8fedc129c6e3c34e44aae3d1aced1d723bc531730b08f5
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections

  • f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27
    .exe windows:6 windows x86 arch:x86

    4ec5227a81c3e90d891321c143c67557


    Headers

    Imports

    Sections