MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
SHA3-384 hash: bf3d19cefcda9dd9daf41db672de2c56fa1e05ebd681055f506afab3b6a92104219ce27fa5c02275e8b923eac7161a61
SHA1 hash: 0cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
MD5 hash: 4bb6c620715fe25e76d4cca1e68bef89
humanhash: fifteen-north-enemy-alpha
File name:0B668D0AC89D5DA1526BE831F7B8C3F2AF54C5DBC68C0.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'244'352 bytes
First seen:2022-01-28 21:05:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:RVELZoHs+s6ZixuEbZjWyeYq973TbVcSXAJW/8:Rutp+jZ3GSy29Hgz
Threatray 4'562 similar samples on MalwareBazaar
TLSH T16745F0DBBA658731D25D1E32DCED041087669E42B11FE70E358E328B1FB33DAB945292
File icon (PE):PE icon
dhash icon 4cb26964b0cc45ba (2 x Rhadamanthys, 1 x RaccoonStealer, 1 x LummaStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer signed

Code Signing Certificate

Organisation:Artline Gaming X65 X65v28Win
Issuer:Artline Gaming X65 X65v28Win
Algorithm:sha1WithRSAEncryption
Valid from:2021-11-29T13:35:06Z
Valid to:2031-11-30T13:35:06Z
Serial number: 5e375305ac92e5a147aad51e7dd8de02
Thumbprint Algorithm:SHA256
Thumbprint: 5af641d2d0f257947c7eebaa9f75d12bcb7add73694b29180d858167647b15aa
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RaccoonStealer C2:
http://159.223.25.220/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://159.223.25.220/ https://threatfox.abuse.ch/ioc/357405/

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://go4crack.com/microsoft-office-crack/
Verdict:
Malicious activity
Analysis date:
2021-12-05 17:20:19 UTC
Tags:
trojan rat redline evasion loader stealer vidar amadey opendir miner
Link:
https://app.any.run/tasks/2b8f1452-4bdc-422d-92a8-2ae3f7c42156

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/225564/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.31544.24605.15092.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated overlay packed replace.exe update.exe
Link:
https://www.filescan.io/uploads/61f45abe6a7929f66a211eab/reports/520dad93-4a27-483a-89c3-e4d8f6f4f70f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19ce7619-d310-499a-b713-ae77ea494644
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929967
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051/
Threat name:
ByteCode-MSIL.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 12:17:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
28 of 39 (71.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bnti2cwitvo2cutl5ay7pogd6kxvjro3y2gazhhiqymd5riyybiq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
25128763bec88f9e6b4a99d05f4aa46fd3694452851fda8b1b5cbc0eb0474fa6
RaccoonStealer
4a47a042c53ecd2836f77477e003095403fe2b4194a48817fc420f8c224131a9
RaccoonStealer
5676e0a540f1996d4866fe92847a70f40b43a8d7a2e4622053126f4b19e318ea
RaccoonStealer
5c40e4f135402126341e3f345eee6bd46e8612988b6df99d6046b546886843bb
RaccoonStealer
a9dc8bc2e80847e41c306c393801632e02efcd1a516cea1104912c4ccaefa8a6
RaccoonStealer
df6c5bd3440d744b7aa2b89a600f623429ab35f956d7b33d93a402c4d1a84828
RaccoonStealer
+ 4'552 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:efc20640b4b1564934471e6297b87d8657db774a stealer suricata
Link:
https://tria.ge/reports/220128-zxsgtadefp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Raccoon
suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6
Unpacked files
SH256 hash:
3bb55b0de90de0cc651dba71c869675c4fb5cfd1b9b21bd4957f1680f7506f06
MD5 hash:
f9d056f1d085e83a64c8ef2ba5f3be52
SHA1 hash:
bf04d73f991d0e45d459a5341593524e4e498801
Link:
https://www.unpac.me/results/7cd86863-9e3d-4a50-ba53-1d35182c5e3a/
SH256 hash:
e79196a498f1a7703639bb0daeccd3fb827a45d14cbf602ab4002a492f844ae0
MD5 hash:
76c11964a9cdd3eb38e24493bcef5ec2
SHA1 hash:
9f5d67397d1303c97dfbd463c2ff8c540fea48f9
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/7cd86863-9e3d-4a50-ba53-1d35182c5e3a/
Parent samples :
a7ae2843ba9ab452c9588cb8a3cd0a1dc4d66d72d23416238af3e256ac269a89
981b90f1d189a21e3b3cc5363f369aa6534614cb63dc76de811aacd583a43b30
94566da96be8685e33c7e21e6b215c53aff7aca4ae105271792e3dcd9e631c63
8f2fe9050989fa67b5075ca8f19c993eac27095da963de63ccbb42e3dc212008
334c12ac95110f2424793e8cb268220e4b89dd622c62849e203481a5ef493c9b
6d7553b09093dc8ff76acdb351b4cef88aebaa05ee58c1ecab5339d03c68a10a
3a3cf64b3e5945a491befc240c35b0d12a4e6c42af37a9d6df6cf457c49c53b1
236dad58970dbb32df7df1c6e317cf5c2a4cba4ec44e872542d926c709026f6c
e282ef9e1d23c80f8ef68d929b2a45352d7932e4f115d662774044b349fe7857
665d4b7c4bec54b430a47f22608d377f3a96775cf5edfee297265e385461266e
0f31fcaa49855c3a40398e2e85604dc062bb4f51e538d689dad2851ea18760ab
2a9103251afe0c1ef6438869cd7f2ab6a9cd3ba724d527bd41dc58834a800256
73e25ced557e8008074958707573a4d6ad68e3861d04a98a22cfdaed57fab84f
1d18c3c86d70c5371e761ba77c60c9361183edc26368e56b5c0d1c3ea8d150ea
c082990403156e860fc5397a9d28d44325bcb24d24a97ad048f1d311a5109451
0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
06dcc8ec05a3ec53b0066ce702d40993f9862644a37ddce050e03b23ba65a746
SH256 hash:
b19104b568ca3ddccc2a8d3d10ecddb1ea240171e798dc3a486292cfa14b6365
MD5 hash:
7b0900da932f4ed9630d65b04422736d
SHA1 hash:
6fa340436e3a8e73ae2b3e911f861483183c68ef
Link:
https://www.unpac.me/results/7cd86863-9e3d-4a50-ba53-1d35182c5e3a/
SH256 hash:
0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
MD5 hash:
4bb6c620715fe25e76d4cca1e68bef89
SHA1 hash:
0cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
Link:
https://www.unpac.me/results/7cd86863-9e3d-4a50-ba53-1d35182c5e3a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/225564/

Comments