MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 100e3672cb4a3eae829997569319617902e68ab0896dd65bff4d8ab445917876. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 10

Intelligence 10 IOCs 2 YARA File information Comments

SHA256 hash:	100e3672cb4a3eae829997569319617902e68ab0896dd65bff4d8ab445917876
SHA3-384 hash:	f727f3a8eea03a13abc2d4ddb14dc5c954af95423f814d2f4a0a0fa4ed1eee0480325f03bb82c230298931e2dc989294
SHA1 hash:	c67dccb946f2eb2b1bedbca71046b2712cf375ed
MD5 hash:	353d7bc50f9b71ed7af3ad9549859621
humanhash:	football-fix-quiet-green
File name:	353d7bc50f9b71ed7af3ad9549859621.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	183'296 bytes
First seen:	2021-09-28 05:31:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	006a79ea8a61231651632116bf97f2d7 (5 x ArkeiStealer, 5 x RaccoonStealer, 1 x CoinMiner)
ssdeep	3072:hI68F3NvfsZ+L6ggX8qfPSSQOB6klGfLIQVNWBz:hOd3s50qfKOB6k8Txql
Threatray	1'874 similar samples on MalwareBazaar
TLSH	T10504CF10FFD0D832D7461531881BCBE565FABDB11B25562333A82A5F6F732B092263B6
File icon (PE):
dhash icon	4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
185.92.74.142:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.92.74.142:80	https://threatfox.abuse.ch/ioc/227056/
http://185.138.164.150/	https://threatfox.abuse.ch/ioc/227268/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

353d7bc50f9b71ed7af3ad9549859621.exe

Verdict:

Suspicious activity

Analysis date:

2021-09-28 05:35:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6e9ecf8d-5198-4d9f-97d5-2b4dda26d081

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/192312/

Detection(s):

Win.Packed.Generic-9897371-0

Win.Packed.Generic-9897389-0

Win.Packed.Generic-9897397-0

Win.Packed.Generic-9897405-0

Win.Packed.Generic-9897409-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d34df7f-9700-400f-9bcf-6e94be3cc599

Result

Threat name:

Raccoon RedLine SmokeLoader Tofsee

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/859495

Signature

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Uses known network protocols on non-standard ports

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/100e3672cb4a3eae829997569319617902e68ab0896dd65bff4d8ab445917876/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-09-28 00:40:22 UTC

AV detection:

23 of 45 (51.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cahdm4wlji7k5auzs5ljgglbpeboncvqrfw5mw77jwflirmrpb3a._file

Verdict:

malicious

RaccoonStealer

467425771038209d08868a51e6bbb8834fa53a33762f15818bd9905f5663828a

RaccoonStealer

5758800ba2a45f64a6cf7f011159fb521eeacbd18c441adf2748690eee7faa00

RaccoonStealer

5ed39b2c2b58db059b65bd11c6783a1c65b9836143f2c4dfbde502ff685598db

RaccoonStealer

674006b8cf885bb27c186c2ef23ee6b9b5b9894985b909021eebcaccb74d6845

RaccoonStealer

8350538160b089becbb7142d16ecf8089b16fbf11ead40dc1169a9e6104c0304

RaccoonStealer

843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0

RaccoonStealer

89bad428ef1f3d8d2217fa8fbf5421824383232f60c1d72fb4ad80ee0c56663f

RaccoonStealer

e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143

RaccoonStealer

f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167

RaccoonStealer

+ 1'864 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:a72c96f6762e4258a13dee8bc0dd14557df18467 botnet:instashop botnet:payper botnet:z0rm1onbuild backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan

Link:

https://tria.ge/reports/210928-f8btnaafd8/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner Payload

Raccoon

RedLine

RedLine Payload

SmokeLoader

Tofsee

Windows security bypass

xmrig

Malware Config

C2 Extraction:

http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
92.246.89.6:38437
45.156.21.209:56326
185.92.74.142:80
185.215.113.216:23998