MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a
SHA3-384 hash:	e1a15915a391fd2dddb3342393cb6983d115cfe5fe8a5bc7bca2f788e7e43078151c5ffe6ffcb23b80ea3be39e73a67a
SHA1 hash:	ec70a27f105436facef71c64c6e2f041b4f0bd14
MD5 hash:	7fc16f01da38a340be2ebea016aeb3ff
humanhash:	purple-east-comet-coffee
File name:	7fc16f01da38a340be2ebea016aeb3ff.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	480'768 bytes
First seen:	2020-12-28 17:36:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2144f9c12885542d4a4f22de64e840e1 (26 x RedLineStealer, 24 x Smoke Loader, 13 x RaccoonStealer)
ssdeep	12288:DLqFH7MGRT533thypgNfZB/Spc5bkCvqfLv3VNkdmk:38H7dRT533iEfZBKe2CWLNNkdj
Threatray	423 similar samples on MalwareBazaar
TLSH	20A423508CA81760D1F04BF2A2EA72C07CFE50B60B07256A3F53DABD4F7EAD598425D6
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
https://minorleage.top/

Intelligence

File Origin

# of uploads :

# of downloads :

405

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7fc16f01da38a340be2ebea016aeb3ff.exe

Verdict:

Malicious activity

Analysis date:

2020-12-28 17:37:40 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/3ea441b4-16c2-4e7d-b61d-e4a6c98d36af

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/109590/

Detection(s):

PUA.Win.Packer.Upolyx-12

PUA.Win.Packer.Upx-4

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Stealing user critical data

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/570891

Signature

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a/

Threat name:

Win32.Trojan.Zenpack

Status:

Malicious

First seen:

2020-12-28 17:37:04 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=eskwemuwuxhkq2dgncqlbtq2tipxzloghgzw7rrusm7l665ayana._file

Verdict:

malicious

RaccoonStealer

3b219425cdb19d82ebaae01c07270435f8bec250679f9b4f18b0ff47a6e9ca37

RaccoonStealer

5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e

RaccoonStealer

6e53f8abd9a57e4613e6afd1148f57dd6c7896c5c84b0ed05a8055b4e8d2fffa

RaccoonStealer

854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422

RaccoonStealer

936cbd7a8071272045f11265e258264cf6638791d133352399860024c763fd8d

RaccoonStealer

9a91c5db492dc2a2acad21ec201c9598d49e76dfec9ca89fef1624cb34c95bdc

RaccoonStealer

c27957506299e9305ef1987aef75bb983e1d6aba96c25c76f4212dbf078368fa

RaccoonStealer

ca4f7d501b768375a9d3f839eb87a1c824f1c9dfdef9f8863332318523ba652a

RaccoonStealer

da0863c8100f03955cdc4f964d9931c1921e46cc1b9318aebc88dff4cfad4906

RaccoonStealer

+ 413 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon discovery spyware stealer upx

Link:

https://tria.ge/reports/201228-66kkp7vqas/

Behaviour

Modifies system certificate store

Checks installed software on the system

JavaScript code in executable

Loads dropped DLL

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Raccoon

Unpacked files

SH256 hash:

2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a

MD5 hash:

7fc16f01da38a340be2ebea016aeb3ff

SHA1 hash:

ec70a27f105436facef71c64c6e2f041b4f0bd14

Link:

https://www.unpac.me/results/8cd03222-83c5-4fb6-967a-a8fb217dcf70/

SH256 hash:

35a33895f9b90824b0be433bb31065a7b9ec616b31d69646fdd56c957ea48774

MD5 hash:

5b462aff23da0a2b928b0ea03649c138

SHA1 hash:

5d32ad59a11a974df553a2cf63597eb6044eba78

Link:

https://www.unpac.me/results/8cd03222-83c5-4fb6-967a-a8fb217dcf70/

SH256 hash:

d9f9718e24dd405db47d99aea06802cb74b67692dfef2bea69049270c4022ad5

MD5 hash:

8ec2b8b6c21c04186397db5eb9452959

SHA1 hash:

d7166fc1c3c0f01f3bf55d2bb8afdacaa28dff6f

Detections:

win_raccoon_a0

win_raccoon_auto

Link:

https://www.unpac.me/results/8cd03222-83c5-4fb6-967a-a8fb217dcf70/

Parent samples :

5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e
49ebef70fa634005cfe5fa3be7b8e2167c64328ebaf3f41e10121b7b1368cd6d
e964b2343b3f9b9f2fe25d4af384ceceeea24e5402622c449487019a9eab21ac
5ec6c811a8d46eb2195ff31ba92ba6bd09711c428047459ff180551ad184255d
fc9515a9819e0faf9b2ab1f485e7d49e10189fdb5b780a8fb779e62586d918b2
4b880328263a8d3318d26b36eaeeda4a2a87962b9b84637a5878a11d5a9df304
3d25ffc1e46e20a1805af68ab5a43c19897b5f3b5772e8435613f3ad3566acd3
9be520f02e0622bd4edb5849c9a2570505228efdb04bb5a1cd758762a261ab02
a674a0aac75570a779915ab71135c4018652df97a0f7161cb0edbb4a5af9303d
3f5236a82af731f886881c3e9abafe621e40b481b220f0b7639387860f795c16
4d7fef569b77cfb9745915b46ca00463029b924260115b8cf36feb1e076d15fa
36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
352f3584318b67778fd06d1d96962117d12cff0a5945b6ae8825e2c1bbdf8b8c
fc4b05b61482306c9dda17cf7af4e3730f952d7f4d8d97d58cb23d872f964717
e793d5cf45831918993bde7e78fd950fd5b5a0b9b7a583819a6d484c5ff8a34e
7d75e67add3d3ea32c9b6dbdc8f9debb87039dec036bb5c01140bb3dc4dea10a
a95f75dfe884a4503d2028aed2cc6415306476b5c08156e064952a5546e9b71d
8fb42af29238207bce70705bf46013f002e6a6e6cc739d910189388117c8fc41
cb445a7c30381ebf9801a9c515a200fda63e80e955e810aff43acb7c0823dabe
2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	win_raccoon_a0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator