MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 24f1f46002ef225c8890e14f154852514104c0c13bc527459f05dc2882da743a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 12
| SHA256 hash: | 24f1f46002ef225c8890e14f154852514104c0c13bc527459f05dc2882da743a |
|---|---|
| SHA3-384 hash: | 3986f9bd92e5436debb79f12e0eea9b76ba807876e18ad04246732b77a074201654d079e1cdbb58a4e1c28145ed415b5 |
| SHA1 hash: | 79e61dbd9de3fdbb4b660bdf1cd0e28d5256a1f0 |
| MD5 hash: | e62035f1024c8c12e85a39f2bd8b79fb |
| humanhash: | spring-uranus-table-leopard |
| File name: | E62035F1024C8C12E85A39F2BD8B79FB.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 1'506'816 bytes |
| First seen: | 2021-08-26 10:41:13 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:YwxfBn9jjMamyhhoM4r1NfE89PKHizGdMBK/PstaemJo8u9vgNL2Me4nbSwA:YwH9nDJho11NjPKCCCBd3mBuE5e8 |
| Threatray | 2'475 similar samples on MalwareBazaar |
| TLSH | T16365DF322944A532E7EDD135809EC52702B99D5EE13D72B61AE836651EF3F3B9B0324C |
| dhash icon | 1424014c4c1a0404 (1 x RaccoonStealer) |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://185.163.47.239/ | https://threatfox.abuse.ch/ioc/195888/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
E62035F1024C8C12E85A39F2BD8B79FB.exe
Verdict:
Malicious activity
Analysis date:
2021-08-26 10:44:00 UTC
Tags:
trojan stealer raccoon
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Connection attempt to an infection source
Connection attempt
Sending an HTTP POST request
Query of malicious DNS domain
Sending a TCP request to an infection source
Malware family:
Raccoon Stealer
Verdict:
Malicious
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Detection:
raccoon
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-08-19 01:11:00 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'465 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:95ddd68c501dee5af06b5d38a630c8c5e02817b3 stealer
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Raccoon
Raccoon Stealer Payload
Unpacked files
SH256 hash:
6912e4bedd1288f116e968f0a79d9797f6d6bd24d45a5f10c52e20f9d33b8c61
MD5 hash:
03bde4a82ad64c0f314985232fbca3fa
SHA1 hash:
e8d0b6339e94192eaaca32c812f914e60576dca6
SH256 hash:
7a611935446b969c280563c22bd1ea8291339c639054471632a8acb4cd44732f
MD5 hash:
cbd6166032afe9782e6a3aabeca87ecb
SHA1 hash:
c6a84a47c4d4b8bf0fc85c8c0ebc8336bf378a80
Detections:
win_raccoon_auto
SH256 hash:
ebd58582e9cda4970837e906c0cad6252097d70b7439a54c4174880d01507746
MD5 hash:
481dfa71ec5f169242d1936fec2ea8f7
SHA1 hash:
82c65ddf8a326d09531ecee86fbccbb31258c4e3
SH256 hash:
8121c1e67c9df7674fd99e6e4bbd32c1406563271f394ec201b3847fa390825e
MD5 hash:
c944aed197815b2b80895cf281c24d5b
SHA1 hash:
3b058d2515fb6483c3400f0b192ab05f8e25eced
SH256 hash:
24f1f46002ef225c8890e14f154852514104c0c13bc527459f05dc2882da743a
MD5 hash:
e62035f1024c8c12e85a39f2bd8b79fb
SHA1 hash:
79e61dbd9de3fdbb4b660bdf1cd0e28d5256a1f0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.