MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894
SHA3-384 hash: cbd15914094d33d5a9b52687ae4c2a7d3904420755514e453b105924683ef2af09c71758f0dbb454c551ae07ce458ab4
SHA1 hash: db45053b0d7d88448895dcbae98a06aaebe6a474
MD5 hash: 2b3f7d0b3e6fe6580dd8b126eac35917
humanhash: fourteen-fifteen-stairway-pizza
File name:2b3f7d0b3e6fe6580dd8b126eac35917.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'433'600 bytes
First seen:2021-01-02 08:16:29 UTC
Last seen:2021-01-02 09:47:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1d674eba90f72ef362ed35e1cb122cae (2 x Amadey, 1 x RaccoonStealer, 1 x AveMariaRAT)
ssdeep 24576:0Ns50MriTZrnRiAdyVVts50M7tBdsPcOSZ4ts50MLIIeHdU95S5bSMT:0Ns5riTBRiayVVts57PScOS6ts5LVKUO
Threatray 375 similar samples on MalwareBazaar
TLSH FC651262FF130863F11619708AF5B7F62BBCAD1761916C0FBFCC79190BB19466AA0532
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2b3f7d0b3e6fe6580dd8b126eac35917.exe
Verdict:
Malicious activity
Analysis date:
2021-01-02 08:19:57 UTC
Tags:
trojan rat azorult stealer vidar loader raccoon remcos
Link:
https://app.any.run/tasks/9e6564b3-a37e-4518-bcd0-419f7bcb2697

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/110291/
Detection(s):
SecuriteInfo.com.Variant.Razy.775357.28253.21307.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT Azorult Raccoon Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/572904
Signature
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 335514 Sample: 0I2ddZZKv7.exe Startdate: 02/01/2021 Architecture: WINDOWS Score: 100 106 agentpurple.ac.ug 2->106 108 agentpapple.ac.ug 2->108 110 4 other IPs or domains 2->110 136 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->136 138 Found malware configuration 2->138 140 Malicious sample detected (through community Yara rule) 2->140 142 16 other signatures 2->142 11 0I2ddZZKv7.exe 3 2->11         started        signatures3 process4 file5 102 C:\Users\user\AppData\Local\...\Pjgdftred.exe, PE32 11->102 dropped 104 C:\Users\user\AppData\Local\...\Ivrdtwer.exe, PE32 11->104 dropped 164 Detected unpacking (changes PE section rights) 11->164 166 Detected unpacking (overwrites its own PE header) 11->166 168 Maps a DLL or memory area into another process 11->168 15 Ivrdtwer.exe 11->15         started        18 0I2ddZZKv7.exe 87 11->18         started        22 Pjgdftred.exe 11->22         started        signatures6 process7 dnsIp8 170 Detected unpacking (changes PE section rights) 15->170 172 Maps a DLL or memory area into another process 15->172 24 Ivrdtwer.exe 71 15->24         started        112 trashbininspector.fun 104.18.59.219, 443, 49741 CLOUDFLARENETUS United States 18->112 114 telete.in 195.201.225.248, 443, 49740 HETZNER-ASDE Germany 18->114 74 C:\Users\user\AppData\...\pWtC4qUlXV.exe, PE32 18->74 dropped 76 C:\Users\user\AppData\...\pCt0McFE76.exe, PE32 18->76 dropped 78 C:\Users\user\AppData\...78hGbw1Riqe.exe, PE32 18->78 dropped 80 60 other files (1 malicious) 18->80 dropped 174 Tries to steal Mail credentials (via file access) 18->174 29 NhGbw1Riqe.exe 18->29         started        31 pWtC4qUlXV.exe 18->31         started        33 GG5nvg5isH.exe 18->33         started        37 2 other processes 18->37 176 Detected unpacking (overwrites its own PE header) 22->176 35 Pjgdftred.exe 188 22->35         started        file9 signatures10 process11 dnsIp12 128 rebelfgighter.ac.ug 194.61.53.10, 49742, 49744, 49751 M247GB Russian Federation 24->128 84 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 24->84 dropped 86 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 24->86 dropped 88 C:\Users\user\AppData\Local\Temp\ds1.exe, PE32 24->88 dropped 98 49 other files (none is malicious) 24->98 dropped 148 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->148 150 Tries to steal Instant Messenger accounts or passwords 24->150 152 Tries to steal Mail credentials (via file access) 24->152 162 2 other signatures 24->162 39 rc.exe 24->39         started        43 ds2.exe 24->43         started        45 ds1.exe 24->45         started        90 C:\Users\user\AppData\Local\...\tmp46AB.tmp, XML 29->90 dropped 92 C:\Users\user\AppData\...\IAapkDPBpUFkb.exe, PE32 29->92 dropped 154 Injects a PE file into a foreign processes 29->154 47 NhGbw1Riqe.exe 29->47         started        49 schtasks.exe 29->49         started        130 cdn.discordapp.com 162.159.135.233 CLOUDFLARENETUS United States 31->130 132 discord.com 162.159.136.232, 443, 49753 CLOUDFLARENETUS United States 31->132 94 C:\Users\user\AppData\Local\...\Wyprwekn.exe, PE32 31->94 dropped 156 Creates a thread in another existing process (thread injection) 31->156 51 WerFault.exe 31->51         started        53 GG5nvg5isH.exe 33->53         started        134 malscxa.ac.ug 35->134 96 C:\ProgramData\vcruntime140.dll, PE32 35->96 dropped 100 6 other files (none is malicious) 35->100 dropped 158 Tries to harvest and steal browser information (history, passwords, etc) 35->158 160 Tries to steal Crypto Currency Wallets 35->160 56 cmd.exe 35->56         started        58 3 other processes 37->58 file13 signatures14 process15 dnsIp16 116 162.159.129.233 CLOUDFLARENETUS United States 39->116 118 162.159.137.232 CLOUDFLARENETUS United States 39->118 126 2 other IPs or domains 39->126 144 Creates a thread in another existing process (thread injection) 39->144 146 Injects a PE file into a foreign processes 39->146 60 WerFault.exe 39->60         started        120 agentpurple.ac.ug 47->120 122 agentttt.ac.ug 79.134.225.40 FINK-TELECOM-SERVICESCH Switzerland 47->122 124 192.168.2.1 unknown unknown 47->124 62 conhost.exe 49->62         started        82 C:\Windows\Temp\mem4xkbv.exe, PE32 53->82 dropped 64 cmstp.exe 53->64         started        66 conhost.exe 56->66         started        68 taskkill.exe 56->68         started        70 powershell.exe 58->70         started        file17 signatures18 process19 process20 72 conhost.exe 70->72         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894/
Threat name:
Win32.Trojan.Caynamer
Create hunting rule
Status:
Malicious
First seen:
2021-01-02 05:19:19 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7q666hwqnysqlidaylmi5zu7kbrqzgky76a5uyxdtoabb54zcka._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
azorult
Create hunting rule
Similar samples:
0fd2b5dba8eb6762b397cf61bd9c2ff9de3eefc8eb8c4cbb1002d1b9c96fe5d1
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
50cae11649a917039a3fadf933dcf5d724ce0db6fbe4d29cb0aa590896849ca6
RaccoonStealer
60152e8f49b376387ea78e05be97894b52c0dc862a9906248b12a441e840ee2d
RaccoonStealer
77d3172d77aa45c61b8563dcb13b26bd2f8f9fb4cbc2fcc966966a26f316ba56
RaccoonStealer
ac8a0b325adca9cc88fc6ee32c912024adfe5228024712e1c757183c51260d16
RaccoonStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
RaccoonStealer
c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
RaccoonStealer
c686c7b2fff2ad2853c1d450d44fcf96ff3df67f34205b6b4e0352153893c924
RaccoonStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
RaccoonStealer
+ 365 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:modiloader family:oski family:raccoon discovery evasion infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/210102-d1z1b7a6gj/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Async RAT payload
AsyncRat
Azorult
Contains code to disable Windows Defender
ModiLoader, DBatLoader
Modifies Windows Defender Real-time Protection settings
Oski
Raccoon
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
Unpacked files
SH256 hash:
17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894
MD5 hash:
2b3f7d0b3e6fe6580dd8b126eac35917
SHA1 hash:
db45053b0d7d88448895dcbae98a06aaebe6a474
Link:
https://www.unpac.me/results/2feb5247-02fe-4d99-a787-df34e843e505/
SH256 hash:
6f56eebe084bdef33e2ee215eaee0895ebb60f4e336047f17aaf315db367e0c3
MD5 hash:
bb91c314f2fe8893b58b1609aa7a601e
SHA1 hash:
6ff32f348d7f4b6579205860c2ce6d3ac00db9d4
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/2feb5247-02fe-4d99-a787-df34e843e505/
SH256 hash:
57bc96b43febd0c4a2607cc54bbc780b66929b4d8e979f0ab0841e98d8113f8f
MD5 hash:
b621c81bad2cb94deab21bb2d2b76001
SHA1 hash:
9377f4b3f37fd7682a0a274148d10ea428f69d5f
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/2feb5247-02fe-4d99-a787-df34e843e505/
SH256 hash:
bb7454c0cc838e6781acb7f1aa72c2a3b83e3853d796760329ff540402ba38ec
MD5 hash:
aefbb6ae2871d44aa3a389871fdbb9ae
SHA1 hash:
569b9d4fb1816a9315bd412d263090bd63fb33b9
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/2feb5247-02fe-4d99-a787-df34e843e505/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/615226/
  
URLhaus
https://urlhaus.abuse.ch/url/791257/
  
URLhaus
https://urlhaus.abuse.ch/url/584190/
Cape
Cape
https://www.capesandbox.com/analysis/110291/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/836469/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/

Comments