MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55
SHA3-384 hash: 7ed813c25d9de99c94b024164db591097239b189636b7f7cc42f2d18b2e1fb819f1144ad8b67031ed5044de28c37d464
SHA1 hash: ae72ed3e7ee09b4192e453a20f6883d347b2295f
MD5 hash: 7ff6899d42790d2fba7bdc369399396e
humanhash: bravo-ceiling-orange-gee
File name:7ff6899d42790d2fba7bdc369399396e.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:323'072 bytes
First seen:2021-11-13 19:21:49 UTC
Last seen:2021-11-13 20:35:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ed1b1d17b38d0dd027b889df8df37758 (10 x RaccoonStealer, 4 x Smoke Loader)
ssdeep 3072:js06yd8y01zBl0KBmSbF8d/vIN12etF+Q8yqet2wWZ0GZGo3DvR7LlRT7bkw66XM:jk1UKUdXu2ejD8aPWZ04Go3DJ7P7bRQ
Threatray 8'923 similar samples on MalwareBazaar
TLSH T1DC648D00B7A0C435F5F756F949B693A8B92E7EA1AB3490CF12D526EE86346D0EC30717
File icon (PE):PE icon
dhash icon e8e8e8e8aa62a499 (21 x RaccoonStealer, 11 x ArkeiStealer, 4 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.163.47.175/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.47.175/ https://threatfox.abuse.ch/ioc/247972/

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205527/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.10487.30243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/619010763edf00a722d26c63/reports/d9d5f83c-9e00-4534-99c2-e202f1cf3271/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c39c102-4e7a-45bb-b9ef-753dcb283f28
Result
Threat name:
Raccoon RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888613
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 521086 Sample: TYHcmQpVMn.exe Startdate: 13/11/2021 Architecture: WINDOWS Score: 100 54 185.163.47.175, 49832, 80 MIVOCLOUDMD Moldova Republic of 2->54 56 91.219.236.27, 49830, 80 SERVERASTRA-ASHU Hungary 2->56 72 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->72 74 Antivirus detection for URL or domain 2->74 76 Yara detected SmokeLoader 2->76 78 10 other signatures 2->78 10 TYHcmQpVMn.exe 2->10         started        12 etiaefu 2->12         started        signatures3 process4 signatures5 15 TYHcmQpVMn.exe 10->15         started        112 Multi AV Scanner detection for dropped file 12->112 114 Machine Learning detection for dropped file 12->114 18 etiaefu 12->18         started        process6 signatures7 116 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->116 118 Maps a DLL or memory area into another process 15->118 120 Checks if the current machine is a virtual machine (disk enumeration) 15->120 20 explorer.exe 16 15->20 injected 122 Creates a thread in another existing process (thread injection) 18->122 process8 dnsIp9 58 45.87.154.2, 49788, 80 ASN-POSTLTDRU Russian Federation 20->58 60 216.128.137.31, 443, 49743, 49744 AS-CHOOPAUS United States 20->60 62 8 other IPs or domains 20->62 46 C:\Users\user\AppData\Roaming\etiaefu, PE32 20->46 dropped 48 C:\Users\user\AppData\Local\Temp\F5BD.exe, PE32 20->48 dropped 50 C:\Users\user\AppData\Local\Temp\F30A.exe, PE32 20->50 dropped 52 6 other malicious files 20->52 dropped 88 System process connects to network (likely due to code injection or exploit) 20->88 90 Benign windows process drops PE files 20->90 92 Deletes itself after installation 20->92 94 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->94 25 DE4B.exe 2 20->25         started        29 BF39.exe 20->29         started        31 EDBE.exe 2 20->31         started        33 3 other processes 20->33 file10 signatures11 process12 dnsIp13 64 45.9.20.149, 10844, 49850 DEDIPATH-LLCUS Russian Federation 25->64 96 Multi AV Scanner detection for dropped file 25->96 98 Detected unpacking (changes PE section rights) 25->98 100 Query firmware table information (likely to detect VMs) 25->100 110 3 other signatures 25->110 102 Machine Learning detection for dropped file 29->102 35 BF39.exe 29->35         started        104 Antivirus detection for dropped file 31->104 106 Injects a PE file into a foreign processes 31->106 38 conhost.exe 31->38         started        40 EDBE.exe 31->40         started        66 93.115.20.139, 28978, 49838 MVPShttpswwwmvpsnetEU Romania 33->66 68 162.159.130.233, 443, 49817 CLOUDFLARENETUS United States 33->68 70 cdn.discordapp.com 33->70 108 Contains functionality to inject code into remote processes 33->108 42 WerFault.exe 3 10 33->42         started        44 109.exe 33->44         started        signatures14 process15 signatures16 80 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 35->80 82 Maps a DLL or memory area into another process 35->82 84 Checks if the current machine is a virtual machine (disk enumeration) 35->84 86 Creates a thread in another existing process (thread injection) 35->86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-13 19:29:12 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=baltqk2v7ih3m4kvtw7mlerakqit5lpkzzcfcfqw6a27ogabhjkq._file
Verdict:
malicious
Similar samples:
0a223aa68af0c2af0baabda61d82748629078720a017ef4836f3322a76cb691a
RaccoonStealer
219503ea9a72bfecd77da975355ec88a16e8fea6d9a03ff7cb76c8f573db7a75
RaccoonStealer
433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3
RaccoonStealer
6b5632608c6187fe40fd1e93cea7a0326748b3079955cd9893bb2807b5424982
RaccoonStealer
dbac71914a01e0b5eff5504d1ca5946302afab65dd3b63caaa18d5e8b5bb399b
RaccoonStealer
f4d185f32721b1c2da2dfdf291154a0c3927fea3e267a4f88f99a49d36ef149a
RaccoonStealer
+ 8'913 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader botnet:675718a5f2ce6d3cacf6cb04a512f5637eae995f botnet:superstar backdoor discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/211113-x2891sfde9/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Raccoon
RedLine
RedLine Payload
SmokeLoader
Malware Config
C2 Extraction:
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
185.159.80.90:38637
185.215.113.29:36224
Unpacked files
SH256 hash:
23554c8f1f1fd1e04a9c7053680f186fdbb61155942430095e76bb88552ad78b
MD5 hash:
5e2aad3c6e39abb50541d91e9591b22b
SHA1 hash:
97bb348f06b2ce6fdc5291420c537358e2259a9c
Link:
https://www.unpac.me/results/1d2c07fc-fe4e-4475-8922-1232f9fa53a9/
SH256 hash:
0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55
MD5 hash:
7ff6899d42790d2fba7bdc369399396e
SHA1 hash:
ae72ed3e7ee09b4192e453a20f6883d347b2295f
Link:
https://www.unpac.me/results/1d2c07fc-fe4e-4475-8922-1232f9fa53a9/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0817382b55fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1755148/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1781418/
Cape
Cape
https://www.capesandbox.com/analysis/205527/

Comments