MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 986d66f71c6c330447d39beaac4906d149625bebbc6603e66b604a48fb6b2fbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 2 Comments

SHA256 hash: 986d66f71c6c330447d39beaac4906d149625bebbc6603e66b604a48fb6b2fbf
SHA3-384 hash: 35565e044e258b720c6e480db19d0596a0d50a174026d7ca8b803db163030ba6ecd616f278ad250980298bf134ca3f3a
SHA1 hash: 681a884e4824d496b850d53bf5fd27ddfdd86f20
MD5 hash: 8224672378acd0f87bd4926708ca3104
humanhash: cat-sweet-one-arkansas
File name:8224672378acd0f87bd4926708ca3104.exe
Download: download sample
Signature RaccoonStealer
File size:847'424 bytes
First seen:2020-07-31 10:01:06 UTC
Last seen:2020-07-31 11:09:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 841c66fbfdd98c985cdefc826bf3e1b8
ssdeep 12288:YCf5QfVp4QWAdj0T1AmyeTqlK6NTCk66KAF8C0AoGnQtaVHQD6g:RWpJWYoty7lK6NGk66jZ0SnFHQD6g
TLSH 31058F2EB714DFA0D9C10CF88EB1C2D200FB95B61A0397D691AEA95134EFC7E913517A
Reporter @abuse_ch
Tags:exe RaccoonStealer


Twitter
@abuse_ch
RaccoonStealer C2:
http://34.65.10.107/gate/log.php

Intelligence


File Origin
# of uploads :
2
# of downloads :
26
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.RacStealer
Status:
Malicious
First seen:
2020-07-31 01:49:00 UTC
AV detection:
22 of 31 (70.97%)
Threat level
  5/5
Result
Malware family:
raccoon
Score:
  10/10
Tags:
ransomware spyware discovery stealer family:raccoon
Behaviour
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Modifies system certificate store
Checks installed software on the system
JavaScript code in executable
Reads user/profile data of local email clients
Loads dropped DLL
Deletes itself
Reads user/profile data of web browsers
Raccoon
Raccoon log file
Threat name:
Kryptik
Score:
1.00

Yara Signatures


Rule name:win_raccoon_a0
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 986d66f71c6c330447d39beaac4906d149625bebbc6603e66b604a48fb6b2fbf

(this sample)

  
Delivery method
Distributed via web download

Comments