MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1be2aea95b43a5e74dd37ac1593446d6e6db18e020c67c768ae967cec2d64701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1be2aea95b43a5e74dd37ac1593446d6e6db18e020c67c768ae967cec2d64701
SHA3-384 hash: 085a014410d77eb6ff65c07ca0a7a9563f097ebb891bd53187531dfaffc8c9ff236c395676a32e2f00ec622dfb7e8d66
SHA1 hash: c4d661f2265fcdf7162e88d5a4f2a25272939132
MD5 hash: bc283c742199252200e411708da2d735
humanhash: one-table-cold-neptune
File name:bc283c742199252200e411708da2d735.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'156'760 bytes
First seen:2022-03-12 15:16:00 UTC
Last seen:2022-04-20 10:20:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 24576:/NMSpvXLa8tf+AlX6HZAuePN7CFdOfNcGkEaHNYK38yDVLqTn:F/pfe8QAlaZAnV7GdOflNa5DVLqTn
Threatray 7'315 similar samples on MalwareBazaar
TLSH T1E235338EC1907F26DA070270AFD18E0B517A89D3A7E1FD245567DA0B9BE4489333D87E
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://176.58.98.13/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://176.58.98.13/ https://threatfox.abuse.ch/ioc/394388/

Intelligence

File Origin
# of uploads :
5
# of downloads :
327
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249828/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending an HTTP GET request
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/622cb9370cd58dbd928706c3/reports/d24e1665-8fa3-4f79-854b-2f174318fc3e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0d55d54-8b92-495a-846f-14826782d44f
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/955471
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 587952 Sample: yNniw3a2KS.exe Startdate: 12/03/2022 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 4 other signatures 2->44 8 yNniw3a2KS.exe 1 2->8         started        process3 signatures4 46 Writes to foreign memory regions 8->46 48 Allocates memory in foreign processes 8->48 50 Injects a PE file into a foreign processes 8->50 11 AppLaunch.exe 80 8->11         started        16 conhost.exe 8->16         started        process5 dnsIp6 32 176.58.98.13, 49780, 80 LINODE-APLinodeLLCUS United Kingdom 11->32 34 85.159.212.113, 80 LINODE-APLinodeLLCUS United Kingdom 11->34 36 185.163.204.81, 49779, 80 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE Germany 11->36 24 C:\Users\user\AppData\LocalLow\...\nss3.dll, PE32 11->24 dropped 26 C:\Users\user\AppData\...\mozglue.dll, PE32 11->26 dropped 28 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 11->28 dropped 30 56 other files (none is malicious) 11->30 dropped 52 Tries to steal Mail credentials (via file / registry access) 11->52 54 Tries to harvest and steal browser information (history, passwords, etc) 11->54 56 DLL side loading technique detected 11->56 18 cmd.exe 1 11->18         started        file7 signatures8 process9 process10 20 conhost.exe 18->20         started        22 timeout.exe 1 18->22         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1be2aea95b43a5e74dd37ac1593446d6e6db18e020c67c768ae967cec2d64701/
Threat name:
Win32.Infostealer.Racoon
Create hunting rule
Status:
Malicious
First seen:
2022-03-07 20:56:27 UTC
File Type:
PE (Exe)
AV detection:
21 of 42 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dprk5kk3ios6ototplavsncg23tnwghaeddhy5uk5ft45qwwi4aq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e
RaccoonStealer
4d278086be5f221dcc67070eac0e3751c4a4970d902107e36bcf67d87a83cb9e
RaccoonStealer
7616d28ae0259737b65234b689f0ed88875aaede87f2408068ad41144dd489d0
RaccoonStealer
79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5
RaccoonStealer
8f0ce948ee3b5f284eed19d5065de393931e6979eac0d177464d55e2e470c3e7
RaccoonStealer
a385b37d2fa2ab2967f406195ff31a699b86fc46931f4d71f0e68ca8990f4060
RaccoonStealer
ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43
RaccoonStealer
+ 7'305 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220312-snf9vsgha2/
Behaviour
Program crash
Unpacked files
SH256 hash:
fc36b8b1842ee369b473105b47b800af3a08758e09def02f2f3220d46ef6c70b
MD5 hash:
1d8035a3758e7b8562052a6eb9611490
SHA1 hash:
f01f86a00d260bea180383c019ef9670bfee2535
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/a1ced340-e846-4091-b3a5-e9f254900354/
SH256 hash:
ede004e0ade72fb848d604e7ca79de3908f04144cf0753f92f93790a97f0f46a
MD5 hash:
d108bfe94bb5fac2679fcb98288809ab
SHA1 hash:
ca0edf2b2f09b89abd55accc01a81e9916e6e553
Link:
https://www.unpac.me/results/a1ced340-e846-4091-b3a5-e9f254900354/
SH256 hash:
1be2aea95b43a5e74dd37ac1593446d6e6db18e020c67c768ae967cec2d64701
MD5 hash:
bc283c742199252200e411708da2d735
SHA1 hash:
c4d661f2265fcdf7162e88d5a4f2a25272939132
Link:
https://www.unpac.me/results/a1ced340-e846-4091-b3a5-e9f254900354/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1be2aea95b43/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1be2aea95b43a5e74dd37ac1593446d6e6db18e020c67c768ae967cec2d64701

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249828/

Comments