MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
SHA3-384 hash: 0ec4d0f3d66db9f5003fec2b5dd298fe8990d6e65681aa6b9a094e1e0a92db2c889463f238ba4c389778cc3c1e05ca7d
SHA1 hash: 23fe51d6aa8abe604e625c35577527e838f3492b
MD5 hash: 0b31b956a499a5409d5a0c91e2c21365
humanhash: tango-washington-monkey-december
File name:0b31b956a499a5409d5a0c91e2c21365
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:773'120 bytes
First seen:2021-11-05 10:31:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2c19e8d727961fe75bcdcd452c23e64c (4 x RaccoonStealer, 3 x Smoke Loader, 1 x ArkeiStealer)
ssdeep 12288:C25N81Lu9EREQaxW5gSD7CB7yZH0ousN8sTWhw+GHyfajyAsV+wwO60bn04DCSZR:9X/BDNe7hN8Ikw7yPMixY4
TLSH T1ADF4E05076A1C039F0B222F475B59768B83E7DB2A77854CB22E627EE5A346D0EC74703
File icon (PE):PE icon
dhash icon badacabecee6baa2 (28 x RedLineStealer, 19 x Stop, 13 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0b31b956a499a5409d5a0c91e2c21365
Verdict:
Malicious activity
Analysis date:
2021-11-05 10:44:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c3baae11-5e29-4345-bb21-b4a0e78ee4c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202674/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer glupteba greyware lockbit packed
Link:
https://www.filescan.io/uploads/618508240621d706aeac996f/reports/fe3a1f2f-f58c-49ab-bb08-fc78d1905a36/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d956d899-8ca7-4d6d-80aa-6ad483e7940d
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/883935
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985/
Threat name:
Win32.Trojan.Krypter
Create hunting rule
Status:
Malicious
First seen:
2021-11-05 10:32:06 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fofxndxp7utlllxalq7b2me4nspzjjrnfoukemdjkmcqbdf7xgcq._file
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:8dec62c1db2959619dca43e02fa46ad7bd606400 stealer
Link:
https://tria.ge/reports/211105-mky3lsgefr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
e82323179c6aa25296935c2c0bb2cccc31cbdd6a1e6d5d07cca7cb39ba0e8ecd
MD5 hash:
12c5a03c855eef802d4acc9a88de4b13
SHA1 hash:
9b3277b88cd96f680cf247f8d7dc5bfcc08a0ccb
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/65ec681d-4a54-4c7b-918b-cc7689d8beb9/
Parent samples :
e0ddefa2d8101c3602f8186aa02c5b770e928a162bc3483dc85f605a4e0d03a3
a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
8abe4bc33112ce5bc9ce4ef8b33187c33a537cf540a63eb9562b4a0622f634aa
d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SH256 hash:
2a250188ffe87fa64e93cccf3b197d89d6e5ab8ba8efea9a0149fc0a7f4d8fc3
MD5 hash:
b01767607a52909aec325b1a50853c3d
SHA1 hash:
87418f913d254ae822fb9a814b60db42e615cf60
Link:
https://www.unpac.me/results/65ec681d-4a54-4c7b-918b-cc7689d8beb9/
SH256 hash:
931f53712545be28c7d66cdec08103fe13cad80aaa689e898e87e26195905dd0
MD5 hash:
67ba6bb553fdeaa6b7a783c9f642e642
SHA1 hash:
51d05d93daff50ba168c3a2af312dc6810ad83d9
Link:
https://www.unpac.me/results/65ec681d-4a54-4c7b-918b-cc7689d8beb9/
SH256 hash:
2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
MD5 hash:
0b31b956a499a5409d5a0c91e2c21365
SHA1 hash:
23fe51d6aa8abe604e625c35577527e838f3492b
Link:
https://www.unpac.me/results/65ec681d-4a54-4c7b-918b-cc7689d8beb9/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2b8b768eeffd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1753971/
Cape
Cape
https://www.capesandbox.com/analysis/202674/

Comments


Avatar
zbet commented on 2021-11-05 10:31:32 UTC

url : hxxp://host-host-file6.com/files/9212_1636097441_5476.exe