MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c
SHA3-384 hash:	ca35efe02df3070b5c96ea61cdc33c65f2a6110549023dd0496724d7dedac0af54bdcba4f52c4a72a0a9e5a3aaeea36a
SHA1 hash:	5c35f05d59106ce7850428a403f037e80d198a17
MD5 hash:	67d56c44c8097f14018b2a9bd9f671cd
humanhash:	lactose-cat-sodium-berlin
File name:	Autodesk.AutoCAD.2022.1.1.en.exe
Download:	download sample
Signature	RaccoonStealer Alert Create hunting rule
File size:	6'597'562 bytes
First seen:	2023-02-01 14:26:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	11ea24073ee65343ee563e3160c77fde (11 x RecordBreaker, 3 x RaccoonStealer, 1 x Zyklon)
ssdeep	196608:xmD/cRu3LyA8OYtgd/bS/4jqJK7nmLAqqY:xmq5KjS/ojnBS
TLSH	T1FC6623A3A68016C5E87588389537FDF13EBB7E3ECDC169B862C9B9C124324E59523C17
TrID	30.2% (.EXE) Win64 Executable (generic) (10523/12/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4505/5/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	fe7ee682125292c6 (2 x RaccoonStealer, 2 x CryptBot, 1 x RecordBreaker)
Reporter	Chainskilabs
Tags:	exe RaccoonStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

217

Origin country :

US

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Autodesk.AutoCAD.2022.1.1.en.exe

Verdict:

No threats detected

Analysis date:

2023-02-01 14:28:54 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4ef67b0d-7f24-41d8-b8b0-8474e090a7c9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/359016/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/64499/overview

Behaviour

MalwareBazaar

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63da76b8fcc41339192f01c9/reports/6b0feb96-c649-40d8-a580-bdd1ec01556c/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/2161ecd6-e85a-4767-8d42-fdcc4f343e34

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1163261

Signature

Antivirus / Scanner detection for submitted sample

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c/

ReversingLabs TitaniumCloud Win32.Infostealer.Raccoon

Threat name:

Win32.Infostealer.Raccoon

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-02-01 14:27:10 UTC

File Type:

PE (Exe)

Extracted files:

16

AV detection:

16 of 26 (61.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cjz5o2nnezxu7sdxfwunyzacummpax4mhkckxy7fkqxihxhbjf6a._file

Threatray raccoon

Verdict:

suspicious

Label(s):

raccoon

Alert

Create hunting rule

Hatching Triage raccoon

Result

Malware family:

raccoon

Alert

Create hunting rule

Score:

  10/10

Tags:

family:raccoon botnet:4ee4e2ee5aa36d394f5d44408a602375 stealer

Link:

https://tria.ge/reports/230201-rseq6abh8t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of NtSetInformationThreadHideFromDebugger

Raccoon

Malware Config

C2 Extraction:

http://168.119.60.182/

UnpacMe

Unpacked files

SH256 hash:

1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c

MD5 hash:

67d56c44c8097f14018b2a9bd9f671cd

SHA1 hash:

5c35f05d59106ce7850428a403f037e80d198a17

Link:

https://www.unpac.me/results/519e6593-8ca0-45c3-b8d7-2b9616317d64/

VMRay RecordBreaker

Malware family:

RecordBreaker

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1273d769ad26/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/359016/