MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 5 File information Comments

SHA256 hash:	2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654
SHA3-384 hash:	8cadfd4bdba2566ff83ace8d0dfd0c07697ef0689eeb0abf767cadce474b21dd3952024afb495b312d6b98dd0d767054
SHA1 hash:	16660d042c15bb792255647135e5cc4684700f46
MD5 hash:	6c4b6a82f3204ee73f5082cbc10bd285
humanhash:	sodium-purple-jersey-lima
File name:	6c4b6a82f3204ee73f5082cbc10bd285.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	592'896 bytes
First seen:	2021-02-12 19:34:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	993ed15fcfd31e74e05f96ce220827ab (14 x RaccoonStealer)
ssdeep	12288:kJTOsgcsJlih46rVTAlhTEvOqpSTTkrfb8syBA/kj3uvtbwVqSBlmktBjW:kNOosJli1rVTAltkNpSEryim2sBjW
Threatray	362 similar samples on MalwareBazaar
TLSH	8CC4AF3165724077F17240B0AE68E7A156BDFC704A718D9B73CA0A2E5BF05C2DB21AB7
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6c4b6a82f3204ee73f5082cbc10bd285.exe

Verdict:

Malicious activity

Analysis date:

2021-02-12 19:43:17 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/9816e586-a56f-4585-a6d5-bf2286e15fc9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/116997/

Detection(s):

Win.Malware.Ulise-7344017-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Sending a UDP request

Running batch commands

Launching a process

Sending a TCP request to an infection source

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

raccoon

Link:

https://mwdb.cert.pl/sample/2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2021-02-12 20:27:42 UTC

AV detection:

30 of 46 (65.22%)

Threat level:

5/5

Verdict:

malicious

RaccoonStealer

16e587a78c6af7a68db2eee80ac40ccec784aeb261cfa7bab04c54608dc96324

RaccoonStealer

256344eb42537328e034750e996263275e13fe77e4c5edafd4c625b53db07ae3

RaccoonStealer

4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4

RaccoonStealer

50835c6c6d8bd3415be9849c272876e863b792c035f052a03449aefb646a600a

RaccoonStealer

b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009

RaccoonStealer

b9f26773127ea443af79c294d1b3a16f8d98556976780aff8e98f37a2ac5ad99

RaccoonStealer

d2c1530870532abdf2123652c9f97dc9de79dc8aabbb8cfd185b1011d6cdbb01

RaccoonStealer

e4b66c012c3fc7ea1857807a3fba0aa9b5c70d975a3c3152550709aa0d7cb9e7

RaccoonStealer

ebe987a5cb9ad1bcc702dc23a1baccbc8e7200ce2c7a2d4bb2d7c91110abf48b

RaccoonStealer

+ 352 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:324730a107fc8faf47c841b56b981a382de05954 discovery spyware stealer

Link:

https://tria.ge/reports/210212-535vxlrswj/

Behaviour

Delays execution with timeout.exe

Modifies system certificate store

Suspicious use of WriteProcessMemory

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Raccoon

Unpacked files

SH256 hash:

2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654

MD5 hash:

6c4b6a82f3204ee73f5082cbc10bd285

SHA1 hash:

16660d042c15bb792255647135e5cc4684700f46

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/6c34fe77-62ba-4c36-8de2-dba36014f259/

Parent samples :

90c5e2705fad463d320dc095b073115c7bf5bd1542b98deb87008ec83c925b20
2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654
19d1a823a542c9b1ad03d2bf4d8a4382d549422e3b5dfd663131c669262ff546
0104f14eaed47f8e6d367dcf82261bd01beca877952fffad629aac1a0d000fd9
c7158275bd1aeb9c788acaea6e8e8c683ac897844ccf7ea27a45dc3fe82b58c3

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2a304174fa127b71c62cd03a9091f5404ed6df692231b7e34194b9be959cf654

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator