MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ab928730305a69a52b7bd52726f07c89c37503b8302ee3edf19abc7d5a8e879. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ab928730305a69a52b7bd52726f07c89c37503b8302ee3edf19abc7d5a8e879
SHA3-384 hash: 7f7d95e4d5bb4a22c99aae86dba083ec2d232eddf9edd844cc7df5787e1eac94923e614063e75d0dee7fddc98dbd8df5
SHA1 hash: 71fb17f3f25a9a59266d9ec835f2270e156c5a29
MD5 hash: 104c94cee2f7da7592f20f14f36f87bf
humanhash: seven-table-monkey-fish
File name:SecuriteInfo.com.BehavesLike.Win32.Skintrim.hc.18955
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:535'040 bytes
First seen:2020-05-25 07:53:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ecd4f41eeda1972e1da47508e89f7bef (2 x Gozi, 1 x RaccoonStealer)
ssdeep 12288:vyTOaSY32zjBMNC4d0mMJdgRruVAO9Z5Mvh:vyTO5j+NC44darcb5Q
Threatray 157 similar samples on MalwareBazaar
TLSH 35B4F1C2B291D865C013CA3BB91AD7B05E1D75205E78B6DA2358EE7F1EB12E04523F27
Reporter SecuriteInfoCom
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Skintrim.hc.18955.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 06:28:30 UTC
File Type:
PE (Exe)
Extracted files:
58
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1f41788769bed2b7fa9f0d52c257b57eaf17793d6e02d5b4aea4a4a148d72874
RaccoonStealer
2b54fb9596441cbdb7f2208b41a717adba83c5834a49c534f54d479131f750c1
RaccoonStealer
4aedc1ecfe84e885ec6021198dbb729f438f9f058fb2363a09512cecf776c975
RaccoonStealer
61c47bc44d3877e815be609e98f97eb1b79ee1c9215646570d85cc40aa9c1317
RaccoonStealer
beb2824122982ae356642d0d46c7fba54424687558a35df7e0b22263f9587332
RaccoonStealer
d0b916f3be7c1e77a5bd6865623b7c75fea0eae73526c2b314bae799dbbb09e2
RaccoonStealer
d54f78713ce9ccaaf5b87be9e0273061eb659c547d5882332642b20d71547f79
RaccoonStealer
e6d287e8934bea3f8c237e9095cfebd7e629bb2a9624eafc0b26065e0e03485f
RaccoonStealer
e9ba77b36bd2ca8d3c4486930e2e79d670804bdbec171b8a459c4d1264d7c100
RaccoonStealer
ee9634a80a4ae316b85a7178f0cfd96bf288ae5f8f73d86945b10d4f7addcf14
RaccoonStealer
+ 147 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-e7w37cmzl2/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 1ab928730305a69a52b7bd52726f07c89c37503b8302ee3edf19abc7d5a8e879

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367712/
  
Delivery method
Distributed via web download

Comments