MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fdbe70d55f048a7ee67510ac78997d90032616bd5b8fa2be84b9cd0a1b9e498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 2 Comments

SHA256 hash: 8fdbe70d55f048a7ee67510ac78997d90032616bd5b8fa2be84b9cd0a1b9e498
SHA3-384 hash: 7d35888ae5dc41217117debd36f8f147138426c8ca46893e36c452cf5e4436fa502a64aaaab5fd0f335691a63f18cc88
SHA1 hash: d648fb349ce16abfa9a24e3324d4f9c3b4f6199b
MD5 hash: 5fffa2ad508c9515472253ba9710e372
humanhash: white-spring-mars-minnesota
File name:5fffa2ad508c9515472253ba9710e372.exe
Download: download sample
Signature RaccoonStealer
File size:471'040 bytes
First seen:2020-07-31 11:33:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8ee97c03bd28b9124781da20755d4a85
ssdeep 12288:mB/5qqZTF02rdfH0QhBxbtwpcqvy+EuH:q/FFXUQTIpc04
TLSH B4A41211FAA0C033C09264754861D5617B7AFD71B672A8063774273CAE372E25EBA32F
Reporter @abuse_ch
Tags:exe RaccoonStealer


Twitter
@abuse_ch
RaccoonStealer C2:
http://35.228.248.188/gate/log.php

Intelligence


File Origin
# of uploads :
1
# of downloads :
26
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Racealer
Status:
Malicious
First seen:
2020-07-31 06:30:21 UTC
AV detection:
24 of 31 (77.42%)
Threat level
  5/5
Result
Malware family:
raccoon
Score:
  10/10
Tags:
ransomware discovery stealer family:raccoon spyware
Behaviour
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Modifies system certificate store
JavaScript code in executable
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Raccoon log file
Raccoon
Threat name:
Malicious File
Score:
1.00

Yara Signatures


Rule name:win_raccoon_a0
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 8fdbe70d55f048a7ee67510ac78997d90032616bd5b8fa2be84b9cd0a1b9e498

(this sample)

  
Delivery method
Distributed via web download

Comments