MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96
SHA3-384 hash: b58180c506332484e399aac3ad4000a1706bc3e994cfc048f499a5f91d97e1166b315627b01bc424113db30db75664be
SHA1 hash: e21a6a9286ea4f9a7eeb403804eead0342fd5645
MD5 hash: 19cc436851674447feb94044399159f2
humanhash: johnny-summer-spaghetti-coffee
File name:19CC436851674447FEB94044399159F2.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'104'384 bytes
First seen:2021-07-23 04:25:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:xvvDBXITqkkpwSGD2S+h4FPlvH68On9d1p:F9IekkKSmlFPlY/
Threatray 1'319 similar samples on MalwareBazaar
TLSH T1F83501B9736BA20CDC74C7F91C66E1E267BAA02A122DC6381E88D07D7D7373C5AD0945
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://188.119.112.73/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://188.119.112.73/ https://threatfox.abuse.ch/ioc/162168/

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
19CC436851674447FEB94044399159F2.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 04:26:31 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/28725956-c8ca-4898-9e11-ad5d9a7e4fe0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173491/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/882bce8d-ccb8-478a-8771-d3958b4b6ad8
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/820530
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Contains functionality to compare user and computer (likely to detect sandboxes)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 452941 Sample: Sf891a3Bi4.exe Startdate: 23/07/2021 Architecture: WINDOWS Score: 92 88 www.google.com 2->88 110 Multi AV Scanner detection for submitted file 2->110 112 Yara detected Clipboard Hijacker 2->112 114 .NET source code contains potential unpacker 2->114 116 2 other signatures 2->116 11 Sf891a3Bi4.exe 3 2->11         started        15 sqlcmd.exe 2->15         started        18 CCUpdate.exe 2->18         started        20 sqlcmd.exe 2->20         started        signatures3 process4 dnsIp5 84 C:\Users\user\AppData\...\Sf891a3Bi4.exe.log, ASCII 11->84 dropped 122 Injects a PE file into a foreign processes 11->122 22 Sf891a3Bi4.exe 85 11->22         started        96 192.168.2.1 unknown unknown 15->96 98 www.google.com 15->98 124 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->124 27 sqlcmd.exe 15->27         started        29 cmd.exe 18->29         started        file6 signatures7 process8 dnsIp9 90 188.119.112.73, 49702, 80 SERVERIUS-ASNL Russian Federation 22->90 92 telete.in 195.201.225.248, 443, 49700 HETZNER-ASDE Germany 22->92 94 thddghd.com 31.31.196.98, 443, 49705 AS-REGRU Russian Federation 22->94 76 C:\Users\user\AppData\...\LwkhK2jDAE.exe, PE32 22->76 dropped 78 C:\Users\user\AppData\...\yINNtSnT7U.exe, PE32+ 22->78 dropped 80 C:\Users\user\AppData\...\vcruntime140.dll, PE32 22->80 dropped 82 58 other files (none is malicious) 22->82 dropped 118 Tries to steal Mail credentials (via file access) 22->118 120 Tries to harvest and steal browser information (history, passwords, etc) 22->120 31 LwkhK2jDAE.exe 15 3 22->31         started        35 yINNtSnT7U.exe 5 22->35         started        38 cmd.exe 1 22->38         started        40 schtasks.exe 27->40         started        42 conhost.exe 29->42         started        44 schtasks.exe 29->44         started        file10 signatures11 process12 dnsIp13 100 www.google.com 172.217.168.68, 443, 49706, 49708 GOOGLEUS United States 31->100 102 Hides that the sample has been downloaded from the Internet (zone.identifier) 31->102 104 Injects a PE file into a foreign processes 31->104 106 Contains functionality to compare user and computer (likely to detect sandboxes) 31->106 46 LwkhK2jDAE.exe 31->46         started        74 C:\Users\user\AppData\Local\...\CCUpdate.exe, PE32+ 35->74 dropped 49 cmd.exe 1 35->49         started        52 CCUpdate.exe 35->52         started        54 conhost.exe 38->54         started        56 timeout.exe 1 38->56         started        58 conhost.exe 40->58         started        file14 signatures15 process16 file17 86 C:\Users\user\AppData\Roaming\...\sqlcmd.exe, PE32 46->86 dropped 60 schtasks.exe 46->60         started        108 Uses schtasks.exe or at.exe to add and modify task schedules 49->108 62 conhost.exe 49->62         started        64 schtasks.exe 49->64         started        66 cmd.exe 52->66         started        signatures18 process19 process20 68 conhost.exe 60->68         started        70 conhost.exe 66->70         started        72 schtasks.exe 66->72         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 18:57:01 UTC
AV detection:
30 of 46 (65.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fne5nrqh5rm2xfpyi4ywt6dhhn6wo4rfecjodtrozonwhurflola._file
Verdict:
malicious
Similar samples:
16a3f8b4cef745530b89e1c3200cac6521909adaf28d46d288c91560dad6e6a6
RaccoonStealer
474a473bf46fdbfb5a9344937674c1455d764e74c2cd8892da7d59f68ffadd5c
RaccoonStealer
55dae3a9ea2e8108b1c8552f9605f2a8f8ce7116b055d96cf1c827989ac0efd5
RaccoonStealer
824b934ef0962b68f3fa0fa48bf269e8ab08699bd88cc8fd9c22a4e4eb4a8f88
RaccoonStealer
8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
RaccoonStealer
9410954bb76886dada322d042c540ae8bd49dbd398e2449464bd0cc55cfde7af
RaccoonStealer
c45613b7ffdb689a3510eaa680613b97c0e89a22a83271a87130a6abeb55c782
RaccoonStealer
d6907c6b017e06a1fbe8ca89190beb214916d62cb43c75ce596c29321c4b01af
RaccoonStealer
fe65170a6f6cd5ba0df997262bca40350b650067db206bc83bfaf80da94bba9e
RaccoonStealer
+ 1'309 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
agilenet discovery spyware stealer
Link:
https://tria.ge/reports/210723-g8g5hj6rhn/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
4e46b112aa34b19f0a1ba04bebee510398789c2337b9a85f0942a5a86af20729
MD5 hash:
783f90b2300d0acacbf96e1fab9feb38
SHA1 hash:
eba1fcd11f73475815bcc57bc0756c6773242519
Link:
https://www.unpac.me/results/aad1b552-3e6f-46bc-8948-0c97d0296428/
SH256 hash:
687bcd5961b17cfd25b59fac29af473b264bc63d958d1f662f2ffb8f5e0e781f
MD5 hash:
6c960a31a15bb193d7bccce2a0de5f02
SHA1 hash:
ac4f482cda597575cc8956c093e5a2fab6231983
Link:
https://www.unpac.me/results/aad1b552-3e6f-46bc-8948-0c97d0296428/
SH256 hash:
b659a07ff9e602dc1317eb5647e0b9a1b1a8da63f114b30b7f5c802499151702
MD5 hash:
8f807398b67ffa3ead774bd5518d2063
SHA1 hash:
7e64c3e6a504e1337620c9a9a7c145c71f1cacb6
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/aad1b552-3e6f-46bc-8948-0c97d0296428/
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/aad1b552-3e6f-46bc-8948-0c97d0296428/
SH256 hash:
2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96
MD5 hash:
19cc436851674447feb94044399159f2
SHA1 hash:
e21a6a9286ea4f9a7eeb403804eead0342fd5645
Link:
https://www.unpac.me/results/aad1b552-3e6f-46bc-8948-0c97d0296428/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/173491/

Comments