MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27d4fcfed2b8070e8ead45bf11d9845ac6372538146ff2f49622ba8e07e37938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 2 Comments

SHA256 hash: 27d4fcfed2b8070e8ead45bf11d9845ac6372538146ff2f49622ba8e07e37938
SHA3-384 hash: cdd7abf646a6a791164f928302275206ce0564e01c409eb4a85ffa7fed2218a14a3baf38048841086ade64e17ceed679
SHA1 hash: 371f89d795fd91258fea6786ca890a2e910874da
MD5 hash: 6f687c7a1abbf7656cfffb85d59444b2
humanhash: montana-south-monkey-charlie
File name:6f687c7a1abbf7656cfffb85d59444b2.exe
Download: download sample
Signature RaccoonStealer
File size:847'424 bytes
First seen:2020-07-31 10:15:19 UTC
Last seen:2020-07-31 11:09:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 841c66fbfdd98c985cdefc826bf3e1b8
ssdeep 12288:rCf5QfVp4QWAdj0T1AmyeTqlK6NTCk66KAF8C0AoGnQtaVHQD6L:aWpJWYoty7lK6NGk66jZ0SnFHQD6L
TLSH 53058F2EB714DFA0D9C10CF88EB1C2D200FB95B61A0397D691AEA95134EFC7E913517A
Reporter @abuse_ch
Tags:exe RaccoonStealer


Twitter
@abuse_ch
RaccoonStealer C2:
http://34.65.10.107/gate/log.php

Intelligence


File Origin
# of uploads :
2
# of downloads :
27
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 10:17:04 UTC
AV detection:
24 of 31 (77.42%)
Threat level
  5/5
Result
Malware family:
raccoon
Score:
  10/10
Tags:
ransomware spyware discovery stealer family:raccoon
Behaviour
Suspicious use of WriteProcessMemory
Modifies system certificate store
Delays execution with timeout.exe
Checks installed software on the system
JavaScript code in executable
Deletes itself
Reads user/profile data of web browsers
Loads dropped DLL
Reads user/profile data of local email clients
Raccoon log file
Raccoon
Threat name:
Kryptik
Score:
1.00

Yara Signatures


Rule name:win_raccoon_a0
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 27d4fcfed2b8070e8ead45bf11d9845ac6372538146ff2f49622ba8e07e37938

(this sample)

  
Delivery method
Distributed via web download

Comments