MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23fabb6cec4ce462d1bc0aec4db3259a3b3d10e5d6f3f07ea7c852495a8ef439. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments 1

SHA256 hash:	23fabb6cec4ce462d1bc0aec4db3259a3b3d10e5d6f3f07ea7c852495a8ef439
SHA3-384 hash:	411825028298959938ce98ededbd3e1478856c7c631394e4018c5a8a3e3324dbc0a2a201b1767cedc6d468b6fd896d32
SHA1 hash:	0a44562849e5806bff64b5d0d8a6291c5edce777
MD5 hash:	00c404e4410a6f8c068f52da5a39ebc8
humanhash:	cola-skylark-hamper-july
File name:	00c404e4410a6f8c068f52da5a39ebc8
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	458'752 bytes
First seen:	2021-07-05 01:56:11 UTC
Last seen:	2021-07-05 02:57:44 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:D0WZq/ud6HEbIcbDSqkpWzP9H86qs4gLyW3uxIk+:D04d6uIc/S+d86Jk
TLSH	93A4CF9D762071DFC85BC8768AA92C74EBA0B877970FD2479053269D9E0D987CF180F2
Reporter	zbetcheckin
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

00c404e4410a6f8c068f52da5a39ebc8

Verdict:

No threats detected

Analysis date:

2021-07-05 02:02:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d814e921-2eca-48ba-b6b8-0acb43014eee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/169652/

Detection(s):

SecuriteInfo.com.Trojan.KillProc2.16244.2575.25369.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8380efbf-58ae-44a6-9dfe-85fc33065e93

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/811650

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Found malware configuration

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

raccoon

Link:

https://mwdb.cert.pl/sample/23fabb6cec4ce462d1bc0aec4db3259a3b3d10e5d6f3f07ea7c852495a8ef439/

Threat name:

Win64.Trojan.StellarStealer

Status:

Malicious

First seen:

2021-07-05 00:47:17 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

17 of 46 (36.96%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ep5lw3hmjtsgfun4blwe3mzfti5t2ehf23z7a7vhzbjeswuo6q4q._file

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://tria.ge/reports/210705-1hdgh7dwjj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Core1 .NET packer

Unpacked files

SH256 hash:

23fabb6cec4ce462d1bc0aec4db3259a3b3d10e5d6f3f07ea7c852495a8ef439

MD5 hash:

00c404e4410a6f8c068f52da5a39ebc8

SHA1 hash:

0a44562849e5806bff64b5d0d8a6291c5edce777

Link:

https://www.unpac.me/results/13b8ae49-23d9-4464-9425-257038fb4bb2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/23fabb6cec4ce462d1bc0aec4db3259a3b3d10e5d6f3f07ea7c852495a8ef439

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator