MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20c9ffeb623d11467dd18264df210fc313a19e5fa17a77738aba5f0d430d7ac0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20c9ffeb623d11467dd18264df210fc313a19e5fa17a77738aba5f0d430d7ac0
SHA3-384 hash: 577fb42a163fd31acca36ef833a691b0023cf8cdcee4fef651bc16d83b90cf30b742bb8d2bbf1911889b8b93482cb16a
SHA1 hash: b8f47d8831f5a3caee60481e2e575c67cd0f28a2
MD5 hash: 65e4738a2f6efef7cbaedd8b8796d412
humanhash: william-leopard-paris-music
File name:SecuriteInfo.com.W32.AIDetect.malware1.30216.18401
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:590'336 bytes
First seen:2021-04-17 19:41:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fd4bf10af10a6da7366de6cd4288ec3e (1 x RaccoonStealer, 1 x TaurusStealer, 1 x FickerStealer)
ssdeep 12288:rb1iok/IwYUI3xXcwkYHxaSaNG86+bovV/qXyZPoN:rb0okwwYfNcPYRHY6+bouOPo
Threatray 560 similar samples on MalwareBazaar
TLSH C4C4F11233D0C032D09120758629C7B19EBAB4B5276AA5CFFBD40BB85F54BD3AA3571B
Reporter SecuriteInfoCom
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.30216.18401
Verdict:
Suspicious activity
Analysis date:
2021-04-17 19:42:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/81ddf66b-662e-4285-969a-2282ec8fdbe5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/137163/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.30216.18401.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Sending a TCP request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/683828
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/20c9ffeb623d11467dd18264df210fc313a19e5fa17a77738aba5f0d430d7ac0/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ede7723chuium7orqjsn6iipymj2dhs7uf5ho44kxjpq2qynplaa._file
Verdict:
malicious
Similar samples:
27614f810715e1ac5987d10abdac7e101227f1ff49e470cd0fee680c604d672d
RaccoonStealer
29aa6e0f133e3987c66880baada023ddb1d31b29969d39797a1b944097d928b1
RaccoonStealer
2b4ca2c55ee1aebc8f963c87da8f160c31641bfd75808ad75273239b10dd793a
RaccoonStealer
39a27d15f3d6175331a974825a440d7475187bae0c133a48a1a5155b49a82537
RaccoonStealer
8dc88e24501dff5acf2683104b0313ae866e64d35afaab19ce7e366939b4cc84
RaccoonStealer
ab209ccc810ea02130fb171abe76d01ab1b63db0aa857fc4f769c9c0546a52d1
RaccoonStealer
af971899ab3b2be79d0e30b0426f5c02bacc978546085b0e47628081a55d01cd
RaccoonStealer
b2f42e0c46898da53cb52d2d1a7f7ea2a090b08491c8b89a4e155cf77b6ab9ed
RaccoonStealer
d3762ee9c493b9e8a73718c7675ce7975d7d452a4a846c169c1d044e18ebb096
RaccoonStealer
f8bf48e34c4002e07e7c57dc4eee52abe141b8a9cfb693325229f56cca507d40
RaccoonStealer
+ 550 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:fe080c9bfcbe54ed632d9562ae158e815dbdc717 stealer
Link:
https://tria.ge/reports/210417-efglyg9bzs/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 20c9ffeb623d11467dd18264df210fc313a19e5fa17a77738aba5f0d430d7ac0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1131433/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/137163/

Comments