MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
SHA3-384 hash: 232124a4f815685737ca59720d2eaecc5b96f972f6941225fe2570a86adbc7edc6c7a44c5de9168d7014598431980b6a
SHA1 hash: 5110d54f8e77c98ca24dde4fc7b8c2a2c4780ef2
MD5 hash: b3794d38a4b03fcb0b7b3eaee4ab1c9f
humanhash: robin-delta-colorado-ink
File name:SecuriteInfo.com.Packed-GDTB3794D38A4B0.32073.31697
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:443'904 bytes
First seen:2021-09-23 11:12:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e0383fee3aa7c9c4dbf3a05a98d01075 (4 x RaccoonStealer, 3 x RedLineStealer, 2 x CoinMiner)
ssdeep 12288:Q+dt70ubHBj/SqC6iGo6tWnLPw3oZjBJnK1P:TtXhjuKkLvBEP
Threatray 3'195 similar samples on MalwareBazaar
TLSH T1A49401D276F0C032E6E79A307874D6A58A7BB4F26574558B3FA03ABD6F312C04A61317
File icon (PE):PE icon
dhash icon 1072c093b0381906 (22 x RedLineStealer, 22 x RaccoonStealer, 20 x Stop)
Reporter SecuriteInfoCom
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Packed-GDTB3794D38A4B0.32073.31697
Verdict:
Suspicious activity
Analysis date:
2021-09-23 11:14:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/983bdb10-0b6f-4108-94f8-365c5bc54339

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190731/
Detection(s):
SecuriteInfo.com.Packed-GDTB3794D38A4B0.32073.31697.UNOFFICIAL
Create hunting rule

Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca96d593-d6b6-4512-ab41-9e00ae188b79
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/856788
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-23 11:13:11 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eqh7eobsvpbqbtxvllod6xyq777iwyl3d5hihf4355amqlad6jca._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
09228fe3797c2de61f4cc484d22b7eed17ec9cc7d2e722c650ef525def22801b
RaccoonStealer
13d6a16d6626f7c0967e4dfb75112b136eb97a56f50e2239adcfa4f97dad8a1e
RaccoonStealer
2b02adf3804e5619fd773ca23b73b96b30441ae42fbecab2d08fa0e3e3794cd8
RaccoonStealer
2fb51e6703b097776bf6612dcb9c07caa122762bb77703b4372fa426790894b2
RaccoonStealer
3c95dfb117835ab0edf303278462ff7a513a8b65c8e91d85b918e2eeaf3b9fb2
RaccoonStealer
4536b4f09029d0abdc6d7b2fac07d6df06b6a7f3ba38e8f8de143ad3f24098a5
RaccoonStealer
a10988cafea84ff676e2f8a3c24f9a4f6af043e30437a0673bbfed5034c764f2
RaccoonStealer
c1545e4cff8b74630cf80b0631d197dacedbd3b65725153913c9ebc83e8b9420
RaccoonStealer
e43a9203ce9b7398946020198e343d697bb2dd9190fe9c36b209a3db35872d7b
RaccoonStealer
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
RaccoonStealer
+ 3'185 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:3a0693aace391ad57b292defd202847793de4c76 stealer
Link:
https://tria.ge/reports/210923-nbe4tahehp/
Behaviour
Raccoon
Unpacked files
SH256 hash:
2b846276cddcb96a51df3052f4f63232f4a9615e08df959342185ed0255c3f0c
MD5 hash:
6f5936f1ebe731d1069daa1b20473a6f
SHA1 hash:
e83bd74f6ebb2b095cffb5f534c3ad1d0017c7c3
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/ecdbae7f-d5b1-4ed9-a092-e91f0bddb4bc/
Parent samples :
d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768
39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7
7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332
77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a
f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb
d720677c3d1ae4e2048fba7ff9a80839affa35f45f6abd2643b0de4a0f9bc997
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
SH256 hash:
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
MD5 hash:
b3794d38a4b03fcb0b7b3eaee4ab1c9f
SHA1 hash:
5110d54f8e77c98ca24dde4fc7b8c2a2c4780ef2
Link:
https://www.unpac.me/results/ecdbae7f-d5b1-4ed9-a092-e91f0bddb4bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190731/

Comments