MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085
SHA3-384 hash:	1a34f6668a0e73f776981608b9ea82c803d157647a895e67b69ba629073d30debb6624460ccda9317ef217e00d20e89c
SHA1 hash:	b1309be12990bc2eb6e00faa73a3c25c56a85dee
MD5 hash:	624cd089e715c88fa1d0e7656e7d3b86
humanhash:	oxygen-gee-enemy-uranus
File name:	624cd089e715c88fa1d0e7656e7d3b86.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	438'272 bytes
First seen:	2021-03-13 08:48:21 UTC
Last seen:	2021-03-13 10:31:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cc30f6e59bfe4c4aa3e155047b05a7b3 (2 x RaccoonStealer)
ssdeep	6144:xqoDnuL2IRq0+d4MKjv2VValcVUKRrNxyJi6Ke9jEJJsZEjIE7tvUij:xqo7uTRG4vv2VVa66ANxyQCcOeD7tD
Threatray	589 similar samples on MalwareBazaar
TLSH	F494011039E2C432D54A51B4C864C2A24AB6FCF59B311BDB2BD93F99BF362D09B35253
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

624cd089e715c88fa1d0e7656e7d3b86.exe

Verdict:

Malicious activity

Analysis date:

2021-03-13 08:51:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3ae4dbba-c3d8-4798-b316-a1e7865d09a1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/124093/

Detection(s):

SecuriteInfo.com.Trojan.Siggen12.37169.14604.21327.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending a UDP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Sending a TCP request to an infection source

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/638556

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-03-13 02:37:33 UTC

AV detection:

10 of 27 (37.04%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cdm2w74gidqzaiwgeirwdnsvgvxx5w7ex5ixbdylss7jnpawoccq._file

Verdict:

malicious

RaccoonStealer

352f3584318b67778fd06d1d96962117d12cff0a5945b6ae8825e2c1bbdf8b8c

RaccoonStealer

3a8f6b8aa7bfb84430ba0623be44b4efb47eda325003c6a37c59fa939120b76f

RaccoonStealer

78f5967d8bd5d31343632e8558b9315d9d44d009c923b9c41d417943906f2849

RaccoonStealer

854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422

RaccoonStealer

bcc49344ddab6a3271480eafb423ee292ed4b2d32792f1b79ed72db0ad856665

RaccoonStealer

cc77c899048dadecb42238532dff0969e362bfe01cf5507f1462d71ce58360ba

RaccoonStealer

de79f76f370c9eaa2f7fc5b169f414860d283607fdc4ea9b3980b31cf211da03

RaccoonStealer

e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5

RaccoonStealer

e964b2343b3f9b9f2fe25d4af384ceceeea24e5402622c449487019a9eab21ac

RaccoonStealer

+ 579 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:afefd33a49c7cbd55d417545269920f24c85aa37 discovery spyware stealer

Link:

https://tria.ge/reports/210313-j6csylf2q2/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Raccoon

Unpacked files

SH256 hash:

0a00415f8e43a51ceccaa6599bdb216148fe0cbc895b2acfa137e819cda36681

MD5 hash:

48ff9d7470c13b9de99968bd76f5db1e

SHA1 hash:

5cbe772066d7c7f0b512f58267c1250907b0849e

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/3d65c087-87af-43c9-b1b7-a442bf249b7c/

Parent samples :

6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085
9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55
8fd17cdc025ce08669dae201714f915a869554bd8339fe494dc58b29ec4c8110
2d07abc10994157494bad3b2a9d5181c040fd8e230a168d5b9d9aaf19390ab5d
b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d
9f9db94621c74bf0f8e8d8a4fc2b1319e11f3d87cb90ba8b20c2945a53a6b874

SH256 hash:

10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085

MD5 hash:

624cd089e715c88fa1d0e7656e7d3b86

SHA1 hash:

b1309be12990bc2eb6e00faa73a3c25c56a85dee

Link:

https://www.unpac.me/results/3d65c087-87af-43c9-b1b7-a442bf249b7c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator