MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2be334c13319b84d4a8b5de9fbd8d0a4a8abf39b9eb8cc0c43d99ecdca9edaa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2be334c13319b84d4a8b5de9fbd8d0a4a8abf39b9eb8cc0c43d99ecdca9edaa3
SHA3-384 hash: 6897c20c11cd64d0383387124b71ec34eba8108e82df3d3b9c99227133e7121c4f4a298e6c9f4753c112d54a37712d16
SHA1 hash: 4b7e5c1109c99c37fe684ab74927d36625218449
MD5 hash: b8ef73f993b7718b6267ec0b213717a8
humanhash: twelve-carpet-mississippi-two
File name:IMAGE-06102021.IMG
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'245'184 bytes
First seen:2021-10-06 07:18:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:ql+zKxkpMD/9/qqDH3mA/icw6EPYgqFhQ5c7dPQGR/uMZ9VKOna3KFU42p:q4zhpk/RH/k6EPYgqM5c7d3huMZ7KOG
TLSH T1E845AF102789DF26D67DB77980B1550093F1BA238F23D25E7EB940ED1F22BD08F2665A
Reporter cocaman
Tags:img INVOICE RaccoonStealer


Avatar
cocaman
Malicious email (T1566.001)
From: ""Nicholas Neocleous" <nn@deloitte.com>" (likely spoofed)
Received: "from bizcloud-deloitte.com (unknown [147.182.244.179]) "
Date: "Tue, 05 Oct 2021 18:13:35 +0000"
Subject: "Payment Invoice"
Attachment: "IMAGE-06102021.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ser.MSILHeracles.127.20732.20858.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/615d4db698a6280f3932c40b/reports/40e88065-809d-4177-9c53-ed0150f19863/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2be334c13319b84d4a8b5de9fbd8d0a4a8abf39b9eb8cc0c43d99ecdca9edaa3/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 18:13:02 UTC
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fprtjqjtdg4e2sullxu7xwgqusukx443t24mydcd3gpm3su63krq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/2be334c13319b84d4a8b5de9fbd8d0a4a8abf39b9eb8cc0c43d99ecdca9edaa3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RaccoonStealer

img 2be334c13319b84d4a8b5de9fbd8d0a4a8abf39b9eb8cc0c43d99ecdca9edaa3

(this sample)

RaccoonStealer

Executable exe 2a081b2e6f932f6c6773603ef59b1e66f7961be9df09fbb10282eeef7d6491a0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a081b2e6f932f6c6773603ef59b1e66f7961be9df09fbb10282eeef7d6491a0

Comments