MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 104e6f76d255a0611ac260a00ead95ad0caa5fa678292098d5adb1e11884e23f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 104e6f76d255a0611ac260a00ead95ad0caa5fa678292098d5adb1e11884e23f
SHA3-384 hash: 064cdad1419cb1081407904c688d67cef29142b6a64e66c5a755a65a06ba124e208d6930447954253e17109649ad502f
SHA1 hash: a96494b1e2a09b42ef45e49dd7f5490bdb7eb7b3
MD5 hash: a4ba0999b396228dc58aace198ec6b99
humanhash: alabama-march-queen-jersey
File name:a4ba0999b396228dc58aace198ec6b99.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:120'896 bytes
First seen:2021-10-01 07:41:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cff62fa5d60c26268b201fcb5b9dc813 (28 x RedLineStealer, 19 x RaccoonStealer, 4 x Stop)
ssdeep 1536:vLYEnaH7daP+68SCNgfm1lILddVKbDPtpd5tCD5P5efDtau1a5Y4dC8D:8EabiSI5W/ToD5Be7txmY5g
Threatray 8'317 similar samples on MalwareBazaar
TLSH T1F5C39D7175FDC036E3F756755879C7A4AA3BBC326A70854B3628129E4E32FD08A22353
File icon (PE):PE icon
dhash icon 480c1c4c4f590f14 (27 x Smoke Loader, 12 x Tofsee, 8 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://91.219.236.63/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://91.219.236.63/ https://threatfox.abuse.ch/ioc/229384/

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a4ba0999b396228dc58aace198ec6b99.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-01 07:46:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/26361d21-df6b-437b-878f-3fe2936bd96d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193920/
Detection(s):
Win.Packed.Generic-9896741-0
Create hunting rule

Win.Malware.Generic-9896928-0
Create hunting rule

Win.Packed.Fragtor-9896992-0
Create hunting rule

Win.Malware.Generic-9896993-0
Create hunting rule

Win.Dropper.Fragtor-9897069-0
Create hunting rule

Win.Malware.Generic-9897686-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b12ae078-9bf9-487a-a45c-8dfff312f30c
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/862566
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 494995 Sample: 48b8yNm3Qz.exe Startdate: 01/10/2021 Architecture: WINDOWS Score: 100 68 91.219.236.63, 49881, 80 SERVERASTRA-ASHU Hungary 2->68 70 t.me 149.154.167.99, 443, 49879 TELEGRAMRU United Kingdom 2->70 72 2 other IPs or domains 2->72 110 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->110 112 Antivirus detection for URL or domain 2->112 114 Antivirus detection for dropped file 2->114 116 16 other signatures 2->116 10 48b8yNm3Qz.exe 2->10         started        13 bjjwhbi 2->13         started        15 svchost.exe 2->15         started        17 7 other processes 2->17 signatures3 process4 signatures5 126 Detected unpacking (changes PE section rights) 10->126 19 48b8yNm3Qz.exe 10->19         started        128 Multi AV Scanner detection for dropped file 13->128 130 Machine Learning detection for dropped file 13->130 22 bjjwhbi 13->22         started        132 Changes security center settings (notifications, updates, antivirus, firewall) 15->132 24 MpCmdRun.exe 1 15->24         started        process6 signatures7 118 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 19->118 120 Maps a DLL or memory area into another process 19->120 122 Checks if the current machine is a virtual machine (disk enumeration) 19->122 124 Creates a thread in another existing process (thread injection) 19->124 26 explorer.exe 18 19->26 injected 31 conhost.exe 24->31         started        process8 dnsIp9 78 193.56.146.41, 49805, 9080 LVLT-10753US unknown 26->78 80 216.128.137.31, 80 AS-CHOOPAUS United States 26->80 82 9 other IPs or domains 26->82 60 C:\Users\user\AppData\Roaming\bjjwhbi, PE32 26->60 dropped 62 C:\Users\user\AppData\Local\Temp\D30A.exe, PE32 26->62 dropped 64 C:\Users\user\AppData\Local\Temp\CFBD.exe, PE32 26->64 dropped 66 7 other malicious files 26->66 dropped 134 System process connects to network (likely due to code injection or exploit) 26->134 136 Benign windows process drops PE files 26->136 138 Deletes itself after installation 26->138 140 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->140 33 CFBD.exe 26->33         started        36 411D.exe 26->36         started        38 25F2.exe 15 3 26->38         started        41 4 other processes 26->41 file10 signatures11 process12 dnsIp13 84 Multi AV Scanner detection for dropped file 33->84 86 Detected unpacking (changes PE section rights) 33->86 88 Contains functionality to inject code into remote processes 33->88 44 CFBD.exe 33->44         started        90 Query firmware table information (likely to detect VMs) 36->90 92 Tries to detect sandboxes and other dynamic analysis tools (window names) 36->92 94 Hides threads from debuggers 36->94 96 Tries to detect sandboxes / dynamic malware analysis system (registry check) 36->96 47 conhost.exe 36->47         started        76 cdn.discordapp.com 162.159.134.233, 443, 49816 CLOUDFLARENETUS United States 38->76 98 Machine Learning detection for dropped file 38->98 106 2 other signatures 38->106 49 25F2.exe 38->49         started        58 C:\Users\user\AppData\Local\...\dknlmmcq.exe, PE32 41->58 dropped 100 Antivirus detection for dropped file 41->100 102 Detected unpacking (overwrites its own PE header) 41->102 104 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 41->104 108 2 other signatures 41->108 51 D30A.exe 2 41->51         started        54 conhost.exe 41->54         started        56 conhost.exe 41->56         started        file14 signatures15 process16 dnsIp17 142 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 44->142 144 Maps a DLL or memory area into another process 44->144 146 Checks if the current machine is a virtual machine (disk enumeration) 44->146 148 Creates a thread in another existing process (thread injection) 44->148 74 188.72.208.174, 38430, 49884 WEBZILLANL Netherlands 51->74 signatures18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/104e6f76d255a0611ac260a00ead95ad0caa5fa678292098d5adb1e11884e23f/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 11:27:36 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbhg65wskwqgcgwcmcqa5lmvvugkux5gpausbggvvwy6cgee4i7q._file
Verdict:
malicious
Similar samples:
110758352eac2b65a35d51aedc9f7d0577934f37dc74c9c72266a81967b9cf88
RaccoonStealer
11b4633345982ace9d710465450941598b2f9289f0438c358fa79eb8eaf680c3
RaccoonStealer
2d07d380e31b6e3308b1fba40eed899dd9fce0fbb7d7beca3c708656961b6217
RaccoonStealer
5758800ba2a45f64a6cf7f011159fb521eeacbd18c441adf2748690eee7faa00
RaccoonStealer
5ce23fd6639f4a6e53fb0b1c680dc0bfbd45533d43d8ca8feebf443b523a3e1c
RaccoonStealer
5ed39b2c2b58db059b65bd11c6783a1c65b9836143f2c4dfbde502ff685598db
RaccoonStealer
770a75002164e25891b3663582594cf2a82867ca3b734cc9b366784a252c7e75
RaccoonStealer
948efd6ebccc98309252dee5d98879890e691fc416e6c3e969190f1273f4d61e
RaccoonStealer
e41b34391dba97a98eaf55d59c565a7ad4f279691bc9c96ae3ebadae0c28b309
RaccoonStealer
fa36cff7b919fb2f6e55059a14fccff00670687108f6f3fb736e8629ef6a7828
RaccoonStealer
+ 8'307 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:114кk botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:r botnet:vol2 backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/211001-jjrqcsbca2/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Windows security modification
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Nirsoft
XMRig Miner Payload
Modifies Windows Defender Real-time Protection settings
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
188.72.208.174:38430
193.56.146.60:18243
185.132.134.148:55353
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/810aff2d-ef71-49a4-b766-8ed2fe735283/
SH256 hash:
104e6f76d255a0611ac260a00ead95ad0caa5fa678292098d5adb1e11884e23f
MD5 hash:
a4ba0999b396228dc58aace198ec6b99
SHA1 hash:
a96494b1e2a09b42ef45e49dd7f5490bdb7eb7b3
Link:
https://www.unpac.me/results/810aff2d-ef71-49a4-b766-8ed2fe735283/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/104e6f76d255/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/104e6f76d255a0611ac260a00ead95ad0caa5fa678292098d5adb1e11884e23f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193920/

Comments