MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298
SHA3-384 hash: aa676c8e48fdb860fd44bb20276958dcb48ea1b0f9e216537debead90916572dd442615a4cdc7cccd753940954053cb6
SHA1 hash: 4185141db5402579321714059282892a932661cf
MD5 hash: 75dc0b7ee8ecf84a04ae6dd0ace2f54d
humanhash: georgia-october-lion-whiskey
File name:open this if the doesn't work.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:230'912 bytes
First seen:2021-10-26 15:35:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:dYMM1I+KA805Y+V/yW5/GMiP9L/GdXFldIOSSM9XTeOPNyoHSIoxdQk:s1I+KUhyDMQad9hSDN7Ha
Threatray 4'218 similar samples on MalwareBazaar
TLSH T1B3342A161BD89B29F57F47358178020063F4F612A723E7AEADD160FE1D62B828B1771B
Reporter Anonymous
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
356
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
packed
Link:
https://www.filescan.io/uploads/61782065db358dd15edce556/reports/9669c1b1-073d-4334-822e-ea90be060d93/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b86eab69-c559-4c38-a19a-c2bab5f0e998
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/877157
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Contains functionality to steal Internet Explorer form passwords
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2021-10-26 15:36:06 UTC
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
175857c3f9480499cf56d30f394f885d51ac9ef05bbc1d6bd86d3b4af393c261
RaccoonStealer
4cebb5a9492f91192a5def3c8345b217718a8223a9b845c3eec1e1eeaa8c6060
RaccoonStealer
94036ecca794753179e68c331482c2b42b0c06a067169c8b004fad4e7dda673a
RaccoonStealer
9e05d26ca31990960ecb59a804c99db6c1b07ae9d5afc4a835f04a0aceaea75e
RaccoonStealer
9f11cb88433023075e0ad899c15354f27a9ef34e3d53aee561d391130d77ddaa
RaccoonStealer
e128f0a54c481a677c0cdc5159600956776cc02fe066cec67775958e4d132ee9
RaccoonStealer
ee72d76436717cfab41a33950d641e7e6820d23369b21fe937cc2fc2549c6869
RaccoonStealer
+ 4'208 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:580b491e2149e767dbb79725a6a0395d016c0b15 evasion stealer trojan
Link:
https://tria.ge/reports/211026-s1xglsaadk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Turns off Windows Defender SpyNet reporting
Windows security bypass
Unpacked files
SH256 hash:
8f9b9aac5cb8eef357b6b1eb349ab520e7ba07a6dd00096b896613448b1cb115
MD5 hash:
cfe4738cdbc3bf10492db12ded3a308f
SHA1 hash:
c61bf5c5cb5d09ae0cd50bc678dd3e19a7d7bac4
Link:
https://www.unpac.me/results/c8af8058-6b5d-4492-8b95-93f5d6f3622d/
SH256 hash:
06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298
MD5 hash:
75dc0b7ee8ecf84a04ae6dd0ace2f54d
SHA1 hash:
4185141db5402579321714059282892a932661cf
Link:
https://www.unpac.me/results/c8af8058-6b5d-4492-8b95-93f5d6f3622d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:quakbot_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:silentbuilder_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments