MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb
SHA3-384 hash: 47d8aa556179a1a42e824897aed8df95c21e010f8f81f8b2aaae720ed5461d4469cf50d6fb1762b2d3af9d9da745e89f
SHA1 hash: 594ed4dc9e2a66c9e7bc147b779b40914ecff1bd
MD5 hash: a7c903bb30f41066a670c09194a07955
humanhash: low-nineteen-ceiling-lactose
File name:a7c903bb30f41066a670c09194a07955.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:3'419'712 bytes
First seen:2021-08-08 09:05:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:JOXanYNtzmnI/zxUzvLvn6hZppH2GtbyQjH1nemzR1Hc:Jhn+onxLnYZpF2G37t9c
Threatray 271 similar samples on MalwareBazaar
TLSH T1E8F53350D5D88CEAFC6254F250FA34F2FB7DB9852785CA860F24856C5AC4712EC7ACA3
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
193.56.146.78:54955

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.56.146.78:54955 https://threatfox.abuse.ch/ioc/166031/

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
610203_Voicemod-Pro-21.zip
Verdict:
Malicious activity
Analysis date:
2021-07-29 01:25:10 UTC
Tags:
evasion trojan loader stealer kelihos rat redline autoit raccoon vidar phishing
Link:
https://app.any.run/tasks/d69a2e06-1a7c-4b0a-b06f-4f4a199b4ab3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177231/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Trojanx-9873669-0
Create hunting rule

Win.Packed.SmokeLoader-9873637-1
Create hunting rule

Win.Dropper.Malwarex-9882460-0
Create hunting rule

Win.Malware.Upatre-9882649-1
Create hunting rule

Win.Malware.Upatre-9882660-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Creating a file
Sending a UDP request
Searching for the window
Moving a recently created file
Running batch commands
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Deleting a recently created file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7218deab-20f5-41e0-bcad-1f8a7a15fc4d
Result
Threat name:
RedLine SmokeLoader Socelars Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/828754
Signature
.NET source code contains very large strings
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Submitted sample is a known malware sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 461185 Sample: TFnstDVVLj.exe Startdate: 08/08/2021 Architecture: WINDOWS Score: 100 139 104.21.87.184 CLOUDFLARENETUS United States 2->139 141 212.224.105.106 DE-FIRSTCOLOwwwfirst-colonetDE Germany 2->141 143 5 other IPs or domains 2->143 157 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->157 159 Antivirus detection for URL or domain 2->159 161 Antivirus detection for dropped file 2->161 163 14 other signatures 2->163 13 TFnstDVVLj.exe 10 2->13         started        signatures3 process4 file5 123 C:\Users\user\AppData\...\setup_installer.exe, PE32 13->123 dropped 16 setup_installer.exe 17 13->16         started        process6 file7 79 C:\Users\user\AppData\...\setup_install.exe, PE32 16->79 dropped 81 C:\Users\user\AppData\Local\...\sonia_9.txt, PE32+ 16->81 dropped 83 C:\Users\user\AppData\Local\...\sonia_8.txt, PE32 16->83 dropped 85 12 other files (none is malicious) 16->85 dropped 19 setup_install.exe 1 16->19         started        process8 dnsIp9 145 watira.xyz 104.21.47.76, 49716, 80 CLOUDFLARENETUS United States 19->145 115 C:\Users\user\AppData\...\sonia_9.exe (copy), PE32+ 19->115 dropped 117 C:\Users\user\AppData\...\sonia_7.exe (copy), PE32 19->117 dropped 119 C:\Users\user\AppData\...\sonia_6.exe (copy), PE32 19->119 dropped 121 6 other files (3 malicious) 19->121 dropped 197 Detected unpacking (changes PE section rights) 19->197 199 Performs DNS queries to domains with low reputation 19->199 201 Machine Learning detection for dropped file 19->201 24 cmd.exe 1 19->24         started        26 cmd.exe 1 19->26         started        28 cmd.exe 1 19->28         started        31 7 other processes 19->31 file10 signatures11 process12 signatures13 33 sonia_7.exe 24->33         started        38 sonia_2.exe 26->38         started        203 Submitted sample is a known malware sample 28->203 205 Obfuscated command line found 28->205 207 Uses ping.exe to sleep 28->207 209 Uses ping.exe to check the status of other devices and networks 28->209 40 sonia_1.exe 2 28->40         started        42 sonia_9.exe 31->42         started        44 sonia_8.exe 31->44         started        46 sonia_3.exe 14 31->46         started        48 3 other processes 31->48 process14 dnsIp15 125 194.163.158.120 NEXINTO-DE Germany 33->125 127 37.0.10.236 WKD-ASIE Netherlands 33->127 131 14 other IPs or domains 33->131 87 C:\Users\...\zOWFCvYfdrK__W_Q2W3HNG9h.exe, PE32 33->87 dropped 89 C:\Users\...\uoW5t0w1G5lCtJh1zCSw2pro.exe, PE32 33->89 dropped 91 C:\Users\...\kH78f0o3cKng2azC5dxLm3NB.exe, PE32 33->91 dropped 101 27 other files (26 malicious) 33->101 dropped 165 Drops PE files to the document folder of the user 33->165 167 May check the online IP address of the machine 33->167 169 Tries to harvest and steal browser information (history, passwords, etc) 33->169 171 Disable Windows Defender real time protection (registry) 33->171 173 Detected unpacking (changes PE section rights) 38->173 175 Maps a DLL or memory area into another process 38->175 177 Checks if the current machine is a virtual machine (disk enumeration) 38->177 179 Creates a thread in another existing process (thread injection) 38->179 50 explorer.exe 38->50 injected 181 Creates processes via WMI 40->181 54 sonia_1.exe 40->54         started        129 ip-api.com 208.95.112.1, 49722, 80 TUT-ASUS United States 42->129 133 3 other IPs or domains 42->133 93 C:\Users\user\AppData\Local\Temp\11111.exe, PE32 42->93 dropped 95 C:\Users\user\AppData\...\aaa_v008[1].dll, DOS 42->95 dropped 57 11111.exe 42->57         started        59 cmd.exe 44->59         started        135 2 other IPs or domains 46->135 183 Detected unpacking (overwrites its own PE header) 46->183 137 2 other IPs or domains 48->137 97 C:\Users\user\AppData\Roaming\8996566.exe, PE32 48->97 dropped 99 C:\Users\user\AppData\Roaming\6797978.exe, PE32 48->99 dropped 103 3 other files (none is malicious) 48->103 dropped 61 sonia_5.tmp 48->61         started        63 sonia_4.exe 48->63         started        file16 signatures17 process18 dnsIp19 105 C:\Users\user\AppData\Roaming\bfeshbc, PE32 50->105 dropped 185 Benign windows process drops PE files 50->185 187 Hides that the sample has been downloaded from the Internet (zone.identifier) 50->187 147 live.goatgame.live 104.21.70.98, 443, 49717 CLOUDFLARENETUS United States 54->147 107 C:\Users\user\AppData\Local\Temp\sqlite.dll, PE32 54->107 dropped 65 conhost.exe 54->65         started        189 Machine Learning detection for dropped file 57->189 191 Tries to harvest and steal browser information (history, passwords, etc) 57->191 67 cmd.exe 59->67         started        70 conhost.exe 59->70         started        149 194.163.135.248 NEXINTO-DE Germany 61->149 151 requested404.com 63.250.33.126, 80 NAMECHEAP-NETUS United States 61->151 109 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 61->109 dropped 111 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 61->111 dropped 113 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 61->113 dropped 153 185.125.18.50 QS-ASRU Russian Federation 63->153 file20 signatures21 process22 signatures23 193 Obfuscated command line found 67->193 195 Uses ping.exe to sleep 67->195 72 PING.EXE 67->72         started        75 findstr.exe 67->75         started        77 Triste.exe.com 67->77         started        process24 dnsIp25 155 127.0.0.1 unknown unknown 72->155
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-29 04:50:23 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ginng3hy6if6rrj5ayftaq3qnjmlusoeyjojstew2gmtee3yhdfq._file
Verdict:
unknown
Similar samples:
261b33850dd1404b22acfd5fe7e46806dce68f710f9b21b7ec00a264804e2137
RaccoonStealer
9e74b137b73150bea9b3ef6b987d3af1b3c445163c8ea469e6608d3ebc6062d9
RaccoonStealer
bb7dead4d3da28e16ef45d0019cd42bbd3c4e3454c3042867e7f64aee2439912
RaccoonStealer
d72dd5663947fc7e1bd8903030b3e2fd551d8d938fdc6417d8513a1c4cc49702
RaccoonStealer
df872b0b7c336241db1a1ff9e83100d6ffb2b898a46c0c7b37a47dcbd002b056
RaccoonStealer
f84ae3bdd7a26957eebe4e4893718bd512960c013a8aa4903998af16072c0041
RaccoonStealer
+ 261 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit family:raccoon family:redline family:smokeloader family:socelars family:vidar botnet:706 botnet:aniold aspackv2 backdoor discovery dropper evasion infostealer loader persistence spyware stealer suricata themida trojan upx
Link:
https://tria.ge/reports/210808-q1v6hcxn4j/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Drops startup file
Loads dropped DLL
Modifies file permissions
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
ASPack v2.12-2.42
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Glupteba
Glupteba Payload
MetaSploit
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
Raccoon
RedLine
RedLine Payload
SmokeLoader
Socelars
Suspicious use of NtCreateProcessExOtherParentProcess
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
https://xeronxikxxx.tumblr.com/
liezaphare.xyz:80
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Unpacked files
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
edd2a0334bfcf63a8c9b9d3a148fd6ad7f76a757ea56589b0670cb72d7dce6ff
MD5 hash:
ad6992e6f028f1f9cd8714ad4cf5313e
SHA1 hash:
f837082d106727a30ff849ed3838da6cfdd4b29c
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
ff5b7e9a2d5af436c13951d0746015237e3b12f4d4dc845a92b4e430c098e224
MD5 hash:
8ecc287212bb08f80f80c4ec1a7c6c4c
SHA1 hash:
59d08bda2e494600ed25fd608582b25261ec13b0
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
Parent samples :
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
65341b1f7f4018e163e564b546012d5bfa41a70c9b9926a0b48781ae4e3f9ec3
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
21dd08d2e94b8d6c8c88de59b26ec1bc9a2d2039ae67ff00a2de02702f1e9a8e
MD5 hash:
1d7a9a6d4e5e9684d6b2c3f73b3be453
SHA1 hash:
4f161c9ca9503f01951c74d0704f85987c8f5351
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
0c7db57068a7a3800d0a07927f6fb9920c02420a4952a858c175ce48075327d0
MD5 hash:
442390dc1844c401c1ad388d755309f2
SHA1 hash:
b705367cafb15273b5d82846728575f61e6e1941
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
71f5bb7d9ace05cfb89e95843499c1c19ca1d6c8b1cd66561d24ceb9ffa94862
MD5 hash:
7a99d0912a3371081b8a866c6ff48351
SHA1 hash:
6b1d33d1afec238f49a23be639790145ee0b3dfd
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
Parent samples :
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
SH256 hash:
bfebe04424e0a8621eb53d2d6da9d5c969e4b94e33ea532bb70e9212869ee9eb
MD5 hash:
28ddc420be08a62b8da803d14d0bcb93
SHA1 hash:
587ca5df9f7fdd3c6915f801f8cd15057342193f
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
6c7d057e00b8ecac9ec9c1bf9ec9584c43f0767d0172d66ad726652268209ff2
MD5 hash:
7236d4e75af20131468a737ae0305905
SHA1 hash:
4e417d45128584cda16f2e6e4cfb3ad3be125662
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
6ea92579c10ff6128399ec8092b44388da56b89e83103797601d334d6c866ca0
MD5 hash:
f14bcba48fb3817154228ed4cf9df6cb
SHA1 hash:
26ae758142d6dd0d69d5f4ff127a0d9c633b6690
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
MD5 hash:
eb73f48eaf544bf7e035a58f95f73394
SHA1 hash:
251f0d09f14452538ecfa0924a4618c3c16887e3
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 hash:
c0d18a829910babf695b4fdaea21a047
SHA1 hash:
236a19746fe1a1063ebe077c8a0553566f92ef0f
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
fafa6a982dbdee37473a7d75c1a6b5372a40d19dca602a263437a24ad5ddbc9b
MD5 hash:
ca481f02abf17abf5ec86e7cf4474fac
SHA1 hash:
7d381a240bba3076faf1f5c9d1d39e09df306aae
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
c3a5a353e1c08d957d657cac0292a0f07317aadf6ff21f022077ca8bc3b2d5f8
MD5 hash:
aa4d11f87b503e207b1f22bf5c105572
SHA1 hash:
e88785c978470a6863d85cd1deac3295350f094b
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
SH256 hash:
321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb
MD5 hash:
a7c903bb30f41066a670c09194a07955
SHA1 hash:
594ed4dc9e2a66c9e7bc147b779b40914ecff1bd
Link:
https://www.unpac.me/results/81006593-02f9-4421-a27a-990792db4f99/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/321ad36cf8f2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177231/

Comments