MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae
SHA3-384 hash: cc882bc6acfb446cfb595ebf4474b3cd56bd88cdcea5c9d4b532e9fc6e56accd93daffc9fc007587c1900acdebfa2c00
SHA1 hash: f6ffc921601f7591e0ddcba23ec39ea21b644623
MD5 hash: dcf6b06a2d2848e904d07139803037bc
humanhash: potato-zulu-autumn-high
File name:dcf6b06a2d2848e904d07139803037bc.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'323'008 bytes
First seen:2020-10-09 15:32:20 UTC
Last seen:2020-10-09 17:16:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c527ec4fd7e542f708e9a6ac42ef3593 (5 x RaccoonStealer)
ssdeep 24576:Ms50MQ8J2jz0yZ5BiP1PfEKgs50M/8JrhYxDs50MA8JjzNg2lE:Ms5Q80hBMEKgs5/8DYts5A8JzT2
Threatray 353 similar samples on MalwareBazaar
TLSH 195523369A671623F50649B1ABE012C207BDEC27B647DC2FF78C39190BD1E4952C67B2
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69568/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Creating a file
Deleting a recently created file
Reading critical registry keys
Replacing files
Sending a custom TCP request
Delayed writing of the file
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Sending a TCP request to an infection source
Stealing user critical data
Sending an HTTP POST request to an infection source
Result
Threat name:
Azorult Raccoon Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/486861
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Binary contains a suspicious time stamp
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Sigma detected: Executable Used by PlugX in Uncommon Location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 295876 Sample: 5FZ52QaEy4.exe Startdate: 09/10/2020 Architecture: WINDOWS Score: 100 116 macapslafg.ug 2->116 118 perrymason.ac.ug 2->118 128 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->128 130 Found malware configuration 2->130 132 Malicious sample detected (through community Yara rule) 2->132 134 11 other signatures 2->134 12 5FZ52QaEy4.exe 16 2->12         started        16 cmd.exe 2->16         started        18 taskkill.exe 2->18         started        signatures3 process4 file5 102 C:\Users\user\AppData\...\Iyrebdfasd.exe, PE32 12->102 dropped 104 C:\Users\user\AppData\...behaviorgraphutyuREdbhgv.exe, PE32 12->104 dropped 152 Detected unpacking (changes PE section rights) 12->152 154 Detected unpacking (overwrites its own PE header) 12->154 156 Maps a DLL or memory area into another process 12->156 20 Iyrebdfasd.exe 4 12->20         started        23 GutyuREdbhgv.exe 4 12->23         started        25 5FZ52QaEy4.exe 14 12->25         started        29 dqfv5my5.exe 16->29         started        31 conhost.exe 16->31         started        33 conhost.exe 18->33         started        signatures6 process7 dnsIp8 136 Detected unpacking (changes PE section rights) 20->136 138 Maps a DLL or memory area into another process 20->138 35 Iyrebdfasd.exe 71 20->35         started        140 Detected unpacking (overwrites its own PE header) 23->140 40 GutyuREdbhgv.exe 188 23->40         started        124 globalseodata.top 47.254.169.137, 443, 49705, 49706 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 25->124 126 telete.in 195.201.225.248, 443, 49699 HETZNER-ASDE Germany 25->126 96 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 25->96 dropped 98 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 25->98 dropped 42 powershell.exe 29->42         started        file9 signatures10 process11 dnsIp12 80 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 35->80 dropped 82 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 35->82 dropped 84 C:\Users\user\AppData\Local\Temp\ds1.exe, PE32 35->84 dropped 92 49 other files (1 malicious) 35->92 dropped 142 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 35->142 144 Tries to steal Instant Messenger accounts or passwords 35->144 146 Tries to steal Mail credentials (via file access) 35->146 150 3 other signatures 35->150 44 ac.exe 35->44         started        48 rc.exe 35->48         started        51 ds1.exe 35->51         started        55 2 other processes 35->55 120 foundsomebo.ac.ug 217.8.117.77, 49698, 49700, 49701 CREXFEXPEX-RUSSIARU Russian Federation 40->120 122 letitburns.ug 40->122 86 C:\ProgramData\vcruntime140.dll, PE32 40->86 dropped 88 C:\ProgramData\sqlite3.dll, PE32 40->88 dropped 90 C:\ProgramData\softokn3.dll, PE32 40->90 dropped 94 4 other files (none is malicious) 40->94 dropped 148 Tries to steal Crypto Currency Wallets 40->148 53 cmd.exe 40->53         started        file13 signatures14 process15 dnsIp16 106 C:\Users\user\AppData\Roaming\...\ddvlc.exe, PE32 44->106 dropped 158 Creates an undocumented autostart registry key 44->158 160 Adds a directory exclusion to Windows Defender 44->160 162 Injects a PE file into a foreign processes 44->162 57 powershell.exe 44->57         started        110 cdn.discordapp.com 162.159.133.233, 443, 49710 CLOUDFLARENETUS United States 48->110 112 discord.com 162.159.135.232, 443, 49708, 49709 CLOUDFLARENETUS United States 48->112 114 192.168.2.1 unknown unknown 48->114 108 C:\Users\user\AppData\Local\...behaviorgraphhntnek.exe, PE32 48->108 dropped 164 Allocates memory in foreign processes 48->164 166 Creates a thread in another existing process (thread injection) 48->166 59 ds1.exe 51->59         started        62 conhost.exe 53->62         started        64 taskkill.exe 53->64         started        66 ds2.exe 55->66         started        68 conhost.exe 55->68         started        70 timeout.exe 55->70         started        file17 signatures18 process19 file20 72 conhost.exe 57->72         started        100 C:\Windows\Temp\dqfv5my5.exe, PE32 59->100 dropped 74 cmstp.exe 59->74         started        76 powershell.exe 66->76         started        process21 process22 78 conhost.exe 76->78         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 15:34:07 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=am65pubbokcv2ltb4hopvysl324rgyyqka7anp3qphxxrw4uekxa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
15145ed8e5ae3cf2acf9ad25bbcb3f782c4d8ba9674185d06baa66ae6d17f25a
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
4d8668325ade88f0c153c36d4c01c38900fa11408b24bbe6c65429215e36f007
RaccoonStealer
61198dcb525d78061585053ddc30e99ca70842899622e333eb64d3b68ee7a167
RaccoonStealer
7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a
RaccoonStealer
bcb474ac919440674135c673d8c6a0fc8015a63a15b2849c3346f74a716b5249
RaccoonStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
RaccoonStealer
d8f37e199f10881b2045823553fd64f3f52ec616e24f2235a47dae7c435a3c72
RaccoonStealer
da045fcbd63520920626c45655b87da65e0e6cdc26f7bc20dfbfb6f667be9dbf
RaccoonStealer
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
RaccoonStealer
+ 343 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
trojan infostealer family:azorult spyware family:oski discovery
Link:
https://tria.ge/reports/201009-kmpzm78qgn/
Behaviour
Checks processor information in registry
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Oski
Unpacked files
SH256 hash:
033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae
MD5 hash:
dcf6b06a2d2848e904d07139803037bc
SHA1 hash:
f6ffc921601f7591e0ddcba23ec39ea21b644623
Link:
https://www.unpac.me/results/530c2a4f-efea-4c52-9e28-7e1a6929e5b6/
SH256 hash:
b66552c169319da4f21c4bede587b6fd7158de08beb8c28ff9328d005ee8fc03
MD5 hash:
de69e33df3187b811d0c7cc1caa1696a
SHA1 hash:
bc941b8eb009ebaf731119ba185a400c049ed495
Link:
https://www.unpac.me/results/530c2a4f-efea-4c52-9e28-7e1a6929e5b6/
SH256 hash:
22d31b95f0872359ccb6dd6a260c4b03910fcf16ace126243fdaefa90e4fd393
MD5 hash:
d885212133c706bf69c7adade70f13aa
SHA1 hash:
7943c1f16c9ab75695f8bea9b8afc2302cc25987
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/530c2a4f-efea-4c52-9e28-7e1a6929e5b6/
SH256 hash:
c5b82508b0e3a1e38c1361b8ee61b2b7f8522a38d4458ceb57576a3e74200b78
MD5 hash:
8b408efec2de08569eb51a459af30f3a
SHA1 hash:
eb05178674ad850e2e57059f616972205df4b4ff
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/530c2a4f-efea-4c52-9e28-7e1a6929e5b6/
SH256 hash:
488ea358ad592518f04401753d4321eca110ad14d2f605d33087eab1089e179a
MD5 hash:
96e3d7e20b092c4c7bd5f9971794efac
SHA1 hash:
d7566783c40ee283df94223156bd5004d4bfc893
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/530c2a4f-efea-4c52-9e28-7e1a6929e5b6/
Parent samples :
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae
c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/69568/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/446431/
  
URLhaus
https://urlhaus.abuse.ch/url/615227/
  
URLhaus
https://urlhaus.abuse.ch/url/584190/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/615226/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/677624/
  
URLhaus
https://urlhaus.abuse.ch/url/677630/

Comments