MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments 1

SHA256 hash:	07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822
SHA3-384 hash:	cd0082a5077a3152cc488541efc4bbb37f119961e11626af1051ab91df1fd2c700e4e0a0d7a2c9d031ec032973b26e63
SHA1 hash:	a6c7e711973287c9c149472a94132d102f3b4fe9
MD5 hash:	d40e91dbbe80688907297d37313f1a35
humanhash:	lamp-vermont-nevada-violet
File name:	d40e91dbbe80688907297d37313f1a35.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	576'512 bytes
First seen:	2021-05-20 14:16:04 UTC
Last seen:	2021-05-20 20:06:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9d456e41ef4f6f2344dc7a1eb92dfc95 (1 x RaccoonStealer)
ssdeep	12288:sMyJ7zrgJNX/0Gp0b5ySlYqWsfVfJKkPCJpFoBnDo4q:sxzr090b5yOYqvzKICLiDBq
Threatray	2'113 similar samples on MalwareBazaar
TLSH	1AC4D000A691C039F5F732F48ABA826DA57E79A16739A4CF52D526FA07346F0EC30717
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/159696/

Detection(s):

SecuriteInfo.com.Mal.GandCrypt-B.20911.18373.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Creating a file

Sending a TCP request to an infection source

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822/

Threat name:

Win32.Infostealer.Racealer

Status:

Malicious

First seen:

2021-05-20 11:45:10 UTC

AV detection:

18 of 47 (38.30%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=a6yywjxzhp6veqhuv66gfxexmkwvssjgv37z5twa3z73jj5xbara._file

Verdict:

malicious

RaccoonStealer

27614f810715e1ac5987d10abdac7e101227f1ff49e470cd0fee680c604d672d

RaccoonStealer

4c2dc9d041a919e8367ee723c5a9b8ebcdc41c9e9495b333242d14ce3bb4a2a4

RaccoonStealer

82e9e16b5b07418082d99003446ec83e0157e8c4c507ef1d0fb79dc08efee10a

RaccoonStealer

8896dd2a44120202a979a9c6caa747861d0a5bb77d46ca475384c000e7f0bd57

RaccoonStealer

b2f42e0c46898da53cb52d2d1a7f7ea2a090b08491c8b89a4e155cf77b6ab9ed

RaccoonStealer

d4a3dfb58cd914442e87bc43526948179b85c2ed4483f8421ba4a882fadbe519

RaccoonStealer

f8bf48e34c4002e07e7c57dc4eee52abe141b8a9cfb693325229f56cca507d40

RaccoonStealer

fb5d2b6d9ec1b9c07e64f6b9eb148099f0b43d58dc867102c02b16a9a9152022

RaccoonStealer

fd6ba9b7188a0b11c92287c273eea76f688576dc07eb73b4b42bb0bf061fb393

RaccoonStealer

+ 2'103 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:88cd0f861c0c35b834a6d4d6e91c9e9bd00f4226 spyware stealer

Link:

https://tria.ge/reports/210520-5hdlset7na/

Behaviour

Modifies system certificate store

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Glupteba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

exe 07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1250973/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/159696/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-20 15:28:10 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [B0012.001] Anti-Static Analysis::Argument Obfuscation
2) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
3) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
4) [C0045] File System Micro-objective::Copy File
5) [C0047] File System Micro-objective::Delete File
6) [C0049] File System Micro-objective::Get File Attributes
7) [C0051] File System Micro-objective::Read File
8) [C0052] File System Micro-objective::Writes File
9) [C0033] Operating System Micro-objective::Console
10) [C0040] Process Micro-objective::Allocate Thread Local Storage
11) [C0043] Process Micro-objective::Check Mutex
12) [C0041] Process Micro-objective::Set Thread Local Storage Value
13) [C0018] Process Micro-objective::Terminate Process
14) [C0039] Process Micro-objective::Terminate Thread