MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee
SHA3-384 hash: 95b8cbbe5081a45ef9b808c40ded1fec60a91da7f65a2d2b9aa90da2c5e213fde3d51cc89a9f144c0dd96b0395e5f5f7
SHA1 hash: 3639f3b7635e692ea3a397d34a37cdd771c4ed73
MD5 hash: 534d0c4c689c99de5fa06068311f10d3
humanhash: alabama-alanine-cat-fanta
File name:534D0C4C689C99DE5FA06068311F10D3.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:12'639'183 bytes
First seen:2021-09-11 07:15:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb5bc6ff6263b364dfbfb78bdb48ed59 (54 x Adware.Generic, 18 x RaccoonStealer, 8 x Adware.ExtenBro)
ssdeep 196608:5utpW72KEhMq2zUS+Wdr+qPYoatl0+t/7I9K6Td+70oeQNEZhp7LdCQMGjwQM7lW:Y62HhM9JXdKqPQzcY6k7uQEF7EjlrcL
Threatray 5'347 similar samples on MalwareBazaar
TLSH T125D62317F398553EC4AA27354673A25068FBFAA9F417AE1A67F0C54CCF351C00E3A6A4
dhash icon cc30f0f4b0b2d070 (2 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://5.181.156.77/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.77/ https://threatfox.abuse.ch/ioc/219656/

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
534D0C4C689C99DE5FA06068311F10D3.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-11 07:18:32 UTC
Tags:
installer
Link:
https://app.any.run/tasks/4f9ef853-7f1f-4e66-b090-3795fa4d839a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187022/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1a236806-2aee-4e18-bf28-b9bc0780c268
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/849095
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to register a low level keyboard hook
Contains functionality to steal Internet Explorer form passwords
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 481526 Sample: 7jhVsYnOvn.exe Startdate: 11/09/2021 Architecture: WINDOWS Score: 100 71 www.ytddownloader.com 2->71 73 elb-web-prod-800824085.eu-central-1.elb.amazonaws.com 2->73 99 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->99 101 Malicious sample detected (through community Yara rule) 2->101 103 Antivirus / Scanner detection for submitted sample 2->103 105 3 other signatures 2->105 11 7jhVsYnOvn.exe 2 2->11         started        14 explorer.exe 12 2->14         started        16 explorer.exe 2->16         started        signatures3 process4 file5 69 C:\Users\user\AppData\...\7jhVsYnOvn.tmp, PE32 11->69 dropped 18 7jhVsYnOvn.tmp 5 14 11->18         started        21 chrome.exe 14->21         started        24 ytd.exe 16->24         started        process6 dnsIp7 51 C:\...\is-HMK96.tmp, PE32 18->51 dropped 53 C:\...\aFCDKiW1DOxXjGm.exe (copy), PE32 18->53 dropped 55 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 18->55 dropped 57 2 other files (none is malicious) 18->57 dropped 26 aFCDKiW1DOxXjGm.exe 7 18->26         started        30 YTDSetup.exe 19 119 18->30         started        75 192.168.2.1 unknown unknown 21->75 77 239.255.255.250 unknown Reserved 21->77 33 chrome.exe 21->33         started        79 142.250.102.154, 443, 49802 GOOGLEUS United States 24->79 81 www.ytddownloader.com 24->81 83 6 other IPs or domains 24->83 file8 process9 dnsIp10 59 C:\Users\user\AppData\Local\...behaviorgraphuiHelper.exe, PE32 26->59 dropped 111 Contains functionality to register a low level keyboard hook 26->111 35 GuiHelper.exe 13 26->35         started        38 cmd.exe 1 26->38         started        89 elb-web-prod-800824085.eu-central-1.elb.amazonaws.com 35.158.225.62, 443, 49735, 49740 AMAZON-02US United States 30->89 91 www.ytddownloader.com 30->91 61 C:\Program Files (x86)\...\Uninstall.exe, PE32 30->61 dropped 63 C:\Users\user\AppData\Local\...\nsisdl.dll, PE32 30->63 dropped 65 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 30->65 dropped 67 21 other files (none is malicious) 30->67 dropped 40 explorer.exe 1 30->40         started        42 explorer.exe 30->42         started        93 stats.l.doubleclick.net 142.250.102.156, 443, 49766 GOOGLEUS United States 33->93 95 accounts.google.com 142.250.180.205, 443, 49744 GOOGLEUS United States 33->95 97 15 other IPs or domains 33->97 file11 signatures12 process13 signatures14 107 Contains functionality to steal Internet Explorer form passwords 35->107 109 Maps a DLL or memory area into another process 35->109 44 GuiHelper.exe 35->44         started        47 conhost.exe 38->47         started        process15 dnsIp16 85 5.181.156.77, 49824, 49825, 80 MIVOCLOUDMD Moldova Republic of 44->85 87 telete.in 195.201.225.248, 443, 49823 HETZNER-ASDE Germany 44->87 49 WerFault.exe 44->49         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee/
Threat name:
Win32.Trojan.Telebot
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 10:45:45 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ax6tlhq3xvkkbccnub74b4e6wzwinsiftzes57e4sn3px5sgt3xa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
00b4442af9d1fa3ed6dacb22bd133c65278f3c0aca9c331c16035f6b77c428f9
RaccoonStealer
0a814a1f3ef52e8379da69712873c881699ead13f7ab737f875638313123d181
RaccoonStealer
474ce2d131c8b5cd87ce2f676a803767e6b019b17f6b3d6a11bd10d1c92e6a85
RaccoonStealer
7a6a24f9bc07388b4a27beba0b2c25c4c7800d3e707e0959ff667b431722ad17
RaccoonStealer
7ce31f51f539761f9922bec50d38c6b9c0d6cc3a912517d947bc0a49dd507026
RaccoonStealer
90ca9c7f8b656d2104a812ce9ba2625c1ab3b6ae346df7e6f01c838bf8990bda
RaccoonStealer
cd51b02027d6e08d86b90eaa03b3ecf6ea777a129b9bca1631fdf4ea278e1269
RaccoonStealer
+ 5'337 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:e2b58b2c24d80fcfd249021c5a21ac97c09e40a1 stealer
Link:
https://tria.ge/reports/210911-h3s7vseccl/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Raccoon
Raccoon Stealer Payload
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
2e82a9a5ccfe666142790919de283422a468744f7cda61751b86c93f3dbb7a8d
MD5 hash:
82641cb592334362ca20ecf759c793ca
SHA1 hash:
3fbe2d29c3aefdf9ee842e21731e43995e176769
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
Parent samples :
367f6ba2d6f4014c4f599c1fe5596190f4573c53c8f55564044deada74bcc55c
05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee
SH256 hash:
9a4bd2803c7f45d7384f5b7bf93512badd59ff266071eb5a1900b09895121716
MD5 hash:
a7100326ce454c6756f007a2ea8ea85d
SHA1 hash:
d5444417e1c4fcd83c710498d4c240292577f690
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
d7f8e6800f2c87fec75824e2adf9f366dea1f25dcf3bf6259d54de14491227ee
MD5 hash:
2e60f28b8b3e8e148fc5b19e65c70056
SHA1 hash:
d12e1b540e5d4498c7cded85f5d8f9433ea5508e
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
960bc049970c738fbec8c408d34d8076879f15d799cfee36e2593ce81e3dd5a4
MD5 hash:
a673d2ce0cd846fcd34e93c856b8e705
SHA1 hash:
98f0a32a3679b71ae1d7be232be7be5551e97dfb
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
dd0a1c05c5bff94f890470dbe21c1e0751087bde26ad709bebc3c419a630a150
MD5 hash:
2037439e427f1a0cc7668d5bec21ea99
SHA1 hash:
c77eaf8c32e9fb0b15014745092540f1d698d435
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
13f383aad2abc20d21e8696691c9a41ecd8510d15ae1a259bfd8d8f82b2b3b6c
MD5 hash:
daac3b058093a8d671ad7d87b705b871
SHA1 hash:
eb2666374c2c894cf14b6be5ce417c954c06ba19
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
67e1f4f25e05f2c6caa1e18914716e13069c2e73579a28896b5988d3add5d0e0
MD5 hash:
acd4f074c6b0ba18dd5e42232c9cb675
SHA1 hash:
567a3d3380ca1aba9268ed48d23697eb5dc1f9b5
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
6965b1346c8314cb5b90e02baf9185de47e500be35245cc925c96217893071a9
MD5 hash:
6e0261d477e9c7caee7395b70a12abb2
SHA1 hash:
a66661d3c6c946b3a3299da84af87c6d722ee55d
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
SH256 hash:
05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee
MD5 hash:
534d0c4c689c99de5fa06068311f10d3
SHA1 hash:
3639f3b7635e692ea3a397d34a37cdd771c4ed73
Link:
https://www.unpac.me/results/a019daca-4baf-4225-a476-65dabc891c98/
Malware family:
Raccoon v1.7
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/05fd359e1bbd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187022/

Comments