MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689
SHA3-384 hash: 5410a8af8265f1ea32b14fe4c54062964f1507a1ec6309e8f54af46e72c586187a0241a9e5baebb81ff8ce8c1481cfaa
SHA1 hash: bae6a97dd1fb9cf5c2372ff92588a2b59efd953a
MD5 hash: c4f267cb881e0a7f999b3e639772b351
humanhash: ink-friend-eleven-summer
File name:c4f267cb881e0a7f999b3e639772b351
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:506'368 bytes
First seen:2021-09-20 10:46:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1bd6d269463cc591268b8d14694f5ae5 (11 x RaccoonStealer, 3 x ArkeiStealer, 2 x RedLineStealer)
ssdeep 12288:9Zat9/AuR4MbEqtz2hmNEff6a55TKEpqtz2c55xHQ:9It93yqtz2lfrlqtz2UD
Threatray 3'155 similar samples on MalwareBazaar
TLSH T1A1B4F130A6E0C035E4B712F855AA93B9B83D7AB15B2445CF62D64AFE2734AF49C30357
File icon (PE):PE icon
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://179.43.187.252/ https://threatfox.abuse.ch/ioc/223814/

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c4f267cb881e0a7f999b3e639772b351
Verdict:
Malicious activity
Analysis date:
2021-09-20 10:48:14 UTC
Tags:
trojan stealer raccoon
Link:
https://app.any.run/tasks/566684df-b415-4131-a5fe-88879b7da880

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189393/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.22696.UNOFFICIAL
Create hunting rule

Win.Malware.Raccoon-9894356-1
Create hunting rule

Win.Malware.Generic-9894375-0
Create hunting rule

Win.Malware.Generic-9894376-0
Create hunting rule

Win.Malware.Raccoon-9894475-1
Create hunting rule

Win.Packed.Generic-9894484-0
Create hunting rule

Win.Packed.Fragtor-9894751-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3376e4f1-863d-4147-b7c3-f9c28d41d412
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/853944
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Infostealer behavior detected
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2021-09-19 01:41:52 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjaqhagvhqkhbmjge7jrrfv2a4o7dxn4z6zdx5uhkalnxexbg2eq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0ebf095d8bc7029868cd05f7ad20f51c324755881ade188d88ba8ed94d67f788
RaccoonStealer
237c6adb7012050c271ed33932bbd6a18a86dc18ace5841b5c0d52f3fe79dcc1
RaccoonStealer
28a1d5fa2dc4e99192f634223cd08d146980534b6f51b36842a2d7c471868fd8
RaccoonStealer
5f340f1335f9e6a3d4e5c51eb3097e3bdf4d93645b925f537a45477427b87494
RaccoonStealer
8305a87ead1a68264f4d0f691a4314f86c3b2bdd909d01028219e0d480238cfa
RaccoonStealer
990fc57523f695bbd5814b6b66bf0e3caecd7ccd66900c41faa2edb9ec3e3ea2
RaccoonStealer
a56a640c907fb37b76e27091785c28b2b182967cf7c3c9f2a78d5e72fd754e99
RaccoonStealer
e021c2eeab7d9fa1bfafa82502b1d9b5e4bea406ee10193fa0d7d2e8ee535efd
RaccoonStealer
e206cdfadd769d8506f7dde22b1a3277075506810b455f491ff08fd42707a0a0
RaccoonStealer
e9d0565443dbb2553948e2a89bb580a81470a00ac3108ecb1e67a5a121e9d65c
RaccoonStealer
+ 3'145 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon stealer
Link:
https://tria.ge/reports/210920-mvjexagddp/
Behaviour
Modifies system certificate store
Raccoon
Unpacked files
SH256 hash:
83d2ad84bd98ee73768aaab4852780491ed52778e7487a7b9cda9dc15340194b
MD5 hash:
934b9c124901d719e4e41beef3cb4347
SHA1 hash:
1b4e567b30b3701538bf64e126e4b9b1360eae79
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/cba718c1-0d89-4b7b-9880-ed364def64ce/
Parent samples :
84cb1084ca0ef1fe91c17b9f81878e670eb8883f37cd9cc32bb48ad93ab8cff5
c342fdfec0daba55c2c00a9f2c141668488b2789db1245b842ecf1f4cb43202a
2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689
SH256 hash:
2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689
MD5 hash:
c4f267cb881e0a7f999b3e639772b351
SHA1 hash:
bae6a97dd1fb9cf5c2372ff92588a2b59efd953a
Link:
https://www.unpac.me/results/cba718c1-0d89-4b7b-9880-ed364def64ce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 2a410380d53c1470b12627d31896ba071df1ddbccfb23bf6875016db92e13689

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1635269/
Cape
Cape
https://www.capesandbox.com/analysis/189393/

Comments


Avatar
zbet commented on 2021-09-20 10:46:11 UTC

url : hxxp://zeytinburnucastajanslari.bykmedya.com/rgo.exe