MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9
SHA3-384 hash: cc79aba4e5f0d5c999fafda0f2dbd729ff0c46b02fd76a730b7c595285d207eca1bbff900c3df72f1e270e2b0975dd22
SHA1 hash: e49c4561fb694360024d1ac882df250fe677f2ac
MD5 hash: df89dec366fa01d699bdadba8a5b6d66
humanhash: delaware-massachusetts-saturn-muppet
File name:df89dec366fa01d699bdadba8a5b6d66.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:885'248 bytes
First seen:2021-02-13 20:11:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:2UjBSIz/Nslh0T6wyUgjmLbYMVEXCucU63vGhUsDutzzzGYza6o1+hp6Bp:2Ujz/6j0eJj+b+XY3vGhtuF/GsaPe6
Threatray 459 similar samples on MalwareBazaar
TLSH 5615EFA5A1265F36C4790BFD9C438A040FB6ED93EC26D681BF813DEA15F1B424584CAF
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
df89dec366fa01d699bdadba8a5b6d66.exe
Verdict:
Malicious activity
Analysis date:
2021-02-13 20:14:52 UTC
Tags:
trojan stealer raccoon
Link:
https://app.any.run/tasks/ca865a5f-dcce-4180-a235-79bff9e1c1b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117049/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Deleting a recently created file
Running batch commands
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/607477
Signature
.NET source code contains potential unpacker
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-13 20:12:07 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
16e587a78c6af7a68db2eee80ac40ccec784aeb261cfa7bab04c54608dc96324
RaccoonStealer
19d1a823a542c9b1ad03d2bf4d8a4382d549422e3b5dfd663131c669262ff546
RaccoonStealer
4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4
RaccoonStealer
50835c6c6d8bd3415be9849c272876e863b792c035f052a03449aefb646a600a
RaccoonStealer
5183727d0d1efeb8c406d0f94b128baca13431fed7fc8921173e5dfafdc26e21
RaccoonStealer
86858e54ef062ffaf88f1fe285196d220d9fa32337f575d8eaa056995e292303
RaccoonStealer
90c5e2705fad463d320dc095b073115c7bf5bd1542b98deb87008ec83c925b20
RaccoonStealer
d2c1530870532abdf2123652c9f97dc9de79dc8aabbb8cfd185b1011d6cdbb01
RaccoonStealer
e4b66c012c3fc7ea1857807a3fba0aa9b5c70d975a3c3152550709aa0d7cb9e7
RaccoonStealer
ebe987a5cb9ad1bcc702dc23a1baccbc8e7200ce2c7a2d4bb2d7c91110abf48b
RaccoonStealer
+ 449 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:324730a107fc8faf47c841b56b981a382de05954 discovery spyware stealer
Link:
https://tria.ge/reports/210213-bpm81zqd2j/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Raccoon
Unpacked files
SH256 hash:
2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788
MD5 hash:
987ce346069cf47535e5ac57265c7228
SHA1 hash:
d0085325ed78fcac6d1f605753237abd1c40db22
Link:
https://www.unpac.me/results/5423d5b1-9b68-41c8-8f08-5ecbbb4a53a4/
SH256 hash:
8ee00e0e6ff4e94f9b93db9aa41ec8d0571c7a21d923b7cf6c9a256b62e53ff7
MD5 hash:
1c7761c158c8bfe01805d5cfc5bf6dc7
SHA1 hash:
361b92aad13669025311b6bcf97d88d99550fe23
Link:
https://www.unpac.me/results/5423d5b1-9b68-41c8-8f08-5ecbbb4a53a4/
SH256 hash:
2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654
MD5 hash:
6c4b6a82f3204ee73f5082cbc10bd285
SHA1 hash:
16660d042c15bb792255647135e5cc4684700f46
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/5423d5b1-9b68-41c8-8f08-5ecbbb4a53a4/
Parent samples :
90c5e2705fad463d320dc095b073115c7bf5bd1542b98deb87008ec83c925b20
2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654
19d1a823a542c9b1ad03d2bf4d8a4382d549422e3b5dfd663131c669262ff546
0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9
c7158275bd1aeb9c788acaea6e8e8c683ac897844ccf7ea27a45dc3fe82b58c3
SH256 hash:
0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9
MD5 hash:
df89dec366fa01d699bdadba8a5b6d66
SHA1 hash:
e49c4561fb694360024d1ac882df250fe677f2ac
Link:
https://www.unpac.me/results/5423d5b1-9b68-41c8-8f08-5ecbbb4a53a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1000486/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117049/

Comments