Behavioral task
behavioral1
Sample
su00.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
su00.exe
Resource
win10v2004-20240802-en
General
-
Target
su00.exe
-
Size
116KB
-
MD5
a4705c801e7153285632478f77a9768a
-
SHA1
01f96830b0de3ddfe056800610d0ba98f00502f9
-
SHA256
982a0d1b819db754da8d7b33ec3ce845594e3efaddcc77047664243edd9fb329
-
SHA512
7b502e03d16a55c189bb56e89303b3d47a4e1b331bf961a2d0bb8b22ffe614609351f4f1fc9bd686afec0ea7d934e8637de3bc981f19faa2ddb28c387aee3330
-
SSDEEP
1536:Bpaiq0I2XvL/5kVvpyITHAOEH8pIZ+msXvsfJre8oJ1C7uj9mDL:BpaikE/5SppIZ+m2sfJrebJFqL
Malware Config
Extracted
raccoon
f26f614d4c0bc2bcd6601785661fb5cf
http://83.217.11.34
http://83.217.11.35
-
user_agent
901785252112
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
Processes:
resource yara_rule sample family_raccoon_v2 -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource su00.exe
Files
-
su00.exe.exe windows:6 windows x86 arch:x86
89766042e29aed5fce63c7340618b000
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
LocalAlloc
CheckRemoteDebuggerPresent
CreateFileW
GetProcAddress
LoadLibraryA
user32
DestroyWindow
gdi32
GetObjectW
ole32
CoDecodeProxy
CoInitialize
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE