MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1c1e85ff09ebbcbf9ed57aac37a053aae5e58cd778dc91f2a1eb9c1119b2843a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 10
| SHA256 hash: | 1c1e85ff09ebbcbf9ed57aac37a053aae5e58cd778dc91f2a1eb9c1119b2843a |
|---|---|
| SHA3-384 hash: | 3b4918112829e8963e7ef9bffacd10ac50924fbaa6b6b01ce7da48a40076b061e7350ce1417ec97d27f09ad49f036a69 |
| SHA1 hash: | bc8c0f93ff0fc75448275d539216bbe3bf5ca2e6 |
| MD5 hash: | 8be2a28d5063f4053e1f78ebd401fb77 |
| humanhash: | network-whiskey-nineteen-spring |
| File name: | 8be2a28d5063f4053e1f78ebd401fb77.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 610'816 bytes |
| First seen: | 2021-06-27 13:20:37 UTC |
| Last seen: | 2021-06-27 13:42:52 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7a958e1aed1cf6e81fa8d2a601d98d8a (3 x RaccoonStealer, 1 x DarkVNC) |
| ssdeep | 12288:YOenRqa+BXr6b/C57koViCJBuAtbAICCZZXEHbeA+TeF:LZaeXjkoTAGAI5ZXE7CS |
| Threatray | 1'334 similar samples on MalwareBazaar |
| TLSH | 55D4D000BB81C039E9F636F459BA9368A53EBDB15B2450CB63D12BEE46741F0BD31627 |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://35.246.76.29/ | https://threatfox.abuse.ch/ioc/154454/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8be2a28d5063f4053e1f78ebd401fb77.exe
Verdict:
Malicious activity
Analysis date:
2021-06-27 13:24:02 UTC
Tags:
trojan stealer raccoon loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Verdict:
Malicious
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Racealer
Status:
Malicious
First seen:
2021-06-27 13:21:20 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 1'324 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon discovery spyware stealer
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of WriteProcessMemory
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Unpacked files
SH256 hash:
f544f3fff973fcbe03f521a127a59869b13f16ed391b30242124befa4ecc2dc3
MD5 hash:
342e6b626e5516caf27ea4a42e3dac4a
SHA1 hash:
2366a37c41f1427255550ad2d116d76565ec4cf3
Detections:
win_raccoon_auto
Parent samples :
7dd9c77911362d3bee0d042ab4d9f9088bf4e9cd30b1c3b0082c02c7b86eec1b
1c1e85ff09ebbcbf9ed57aac37a053aae5e58cd778dc91f2a1eb9c1119b2843a
dda0eb627c08fbaa30cedd995f53ded1902e447c543a00f5950812dce24a9009
f3fc2abd99598a304f3b1ba415493fa8cc6ad7057444a10e46ea5c72ea9571a2
a8229a577b8a00a67c7ab25850a9f3c6b57bb036b3e0492b5194cad32a68c0ff
cce575279d97d312432613cd32f727355ee7a0784cfb880c653fe1e1df48f80e
ceba9a4f5114832826e13dcb75d9018eabef56b6b95131cc46bc34d23d846b76
d64cd9ad47506c335d792b8e5a07de1a321a8690f9594d3d0b3a88bcf344d3f3
0a1d59d149d3b9ae44b37d35d468c4bdd18e3d5d137883dd88daadbd7d9aadb6
416ddafb2fba28c5f294206ad42058367e174dda0126978b0ab2dbe461922dee
1c1e85ff09ebbcbf9ed57aac37a053aae5e58cd778dc91f2a1eb9c1119b2843a
dda0eb627c08fbaa30cedd995f53ded1902e447c543a00f5950812dce24a9009
f3fc2abd99598a304f3b1ba415493fa8cc6ad7057444a10e46ea5c72ea9571a2
a8229a577b8a00a67c7ab25850a9f3c6b57bb036b3e0492b5194cad32a68c0ff
cce575279d97d312432613cd32f727355ee7a0784cfb880c653fe1e1df48f80e
ceba9a4f5114832826e13dcb75d9018eabef56b6b95131cc46bc34d23d846b76
d64cd9ad47506c335d792b8e5a07de1a321a8690f9594d3d0b3a88bcf344d3f3
0a1d59d149d3b9ae44b37d35d468c4bdd18e3d5d137883dd88daadbd7d9aadb6
416ddafb2fba28c5f294206ad42058367e174dda0126978b0ab2dbe461922dee
SH256 hash:
1c1e85ff09ebbcbf9ed57aac37a053aae5e58cd778dc91f2a1eb9c1119b2843a
MD5 hash:
8be2a28d5063f4053e1f78ebd401fb77
SHA1 hash:
bc8c0f93ff0fc75448275d539216bbe3bf5ca2e6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Email_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Email in files like avemaria |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many email and collaboration clients. Observed in information stealers |
| Rule name: | MALWARE_Win_Raccoon |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Raccoon/Racealer infostealer |
| Rule name: | win_raccoon_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.