MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
SHA3-384 hash: 9425af55eda3d0cd66f55864d5555c822be5ffaa35654c8add4a6a42cc10129a931b266a9c39ec886123dec440446d27
SHA1 hash: e33bc35055b3dc6bd4ed3120d77765e14f002f03
MD5 hash: b587cf8a0ff2889caac28f7ae0980ba1
humanhash: robert-black-mars-lithium
File name:36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:505'856 bytes
First seen:2020-11-15 23:08:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8374ffcf14bdeef4d5dd99b369159572 (4 x RaccoonStealer)
ssdeep 12288:xq8616LSLwJueCaQNg0iDg/ghoix9Peq39NLF5RFcLp:xq8611w8ZghoifeC9tnc1
Threatray 213 similar samples on MalwareBazaar
TLSH F4B401417110E973C04504B1441AE7AD66BAB4399770AA833F98EB5F2E362D1EFB634F
Reporter seifreed
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-9785889-0
Create hunting rule

Win.Malware.Generic-9785897-0
Create hunting rule

Win.Malware.Generic-9785903-0
Create hunting rule

Win.Malware.Generic-9785951-0
Create hunting rule

Win.Malware.Generic-9785953-0
Create hunting rule

Win.Malware.Generic-9785956-0
Create hunting rule

Win.Malware.Generic-9786159-0
Create hunting rule

Win.Dropper.Tofsee-9787427-0
Create hunting rule

Win.Packed.Emotet-9790742-0
Create hunting rule

SecuriteInfo.com.BackDoor.Generic12.AOUE.3057.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
Sending a TCP request to an infection source
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/537390
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 317791 Sample: fGEOXUlqs3 Startdate: 16/11/2020 Architecture: WINDOWS Score: 84 37 changerightnow.top 2->37 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Raccoon Stealer 2->47 49 Machine Learning detection for sample 2->49 51 Found many strings related to Crypto-Wallets (likely being stolen) 2->51 7 fGEOXUlqs3.exe 1 2->7         started        signatures3 process4 dnsIp5 39 telete.in 195.201.225.248, 443, 49748 HETZNER-ASDE Germany 7->39 41 changerightnow.top 104.27.135.141, 443, 49760, 49778 CLOUDFLARENETUS United States 7->41 43 192.168.2.1 unknown unknown 7->43 21 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 7->21 dropped 53 Detected unpacking (changes PE section rights) 7->53 55 Detected unpacking (overwrites its own PE header) 7->55 57 Contains functionality to steal Internet Explorer form passwords 7->57 12 WerFault.exe 9 7->12         started        15 WerFault.exe 9 7->15         started        17 WerFault.exe 9 7->17         started        19 7 other processes 7->19 file6 signatures7 process8 file9 23 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 12->23 dropped 25 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->25 dropped 27 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->27 dropped 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->33 dropped 35 4 other malicious files 19->35 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875/
Threat name:
Win32.Downloader.Dofoil
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 23:10:09 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g37wf65kyadyolr2m7ntgbgkimdhgrmistaba6akvn3rih7lhb2q._file
Verdict:
malicious
Similar samples:
352f3584318b67778fd06d1d96962117d12cff0a5945b6ae8825e2c1bbdf8b8c
RaccoonStealer
49ebef70fa634005cfe5fa3be7b8e2167c64328ebaf3f41e10121b7b1368cd6d
RaccoonStealer
4b880328263a8d3318d26b36eaeeda4a2a87962b9b84637a5878a11d5a9df304
RaccoonStealer
4d7fef569b77cfb9745915b46ca00463029b924260115b8cf36feb1e076d15fa
RaccoonStealer
501ebf8f394a5c9ce011f60d06fd27e948e40df690c1542903220f5800f19a2c
RaccoonStealer
5ec6c811a8d46eb2195ff31ba92ba6bd09711c428047459ff180551ad184255d
RaccoonStealer
6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5
RaccoonStealer
8a009cd8ec3cd4f491ecceb59231bd3657d3d408bec265618cf90368668b64dd
RaccoonStealer
de79f76f370c9eaa2f7fc5b169f414860d283607fdc4ea9b3980b31cf211da03
RaccoonStealer
fc9515a9819e0faf9b2ab1f485e7d49e10189fdb5b780a8fb779e62586d918b2
RaccoonStealer
+ 203 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware
Link:
https://tria.ge/reports/201115-9av5dc5ace/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
MD5 hash:
b587cf8a0ff2889caac28f7ae0980ba1
SHA1 hash:
e33bc35055b3dc6bd4ed3120d77765e14f002f03
Link:
https://www.unpac.me/results/a403b37f-589b-4a22-a1d0-e0b44452a59a/
SH256 hash:
d9f9718e24dd405db47d99aea06802cb74b67692dfef2bea69049270c4022ad5
MD5 hash:
8ec2b8b6c21c04186397db5eb9452959
SHA1 hash:
d7166fc1c3c0f01f3bf55d2bb8afdacaa28dff6f
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/a403b37f-589b-4a22-a1d0-e0b44452a59a/
Parent samples :
5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e
49ebef70fa634005cfe5fa3be7b8e2167c64328ebaf3f41e10121b7b1368cd6d
e964b2343b3f9b9f2fe25d4af384ceceeea24e5402622c449487019a9eab21ac
5ec6c811a8d46eb2195ff31ba92ba6bd09711c428047459ff180551ad184255d
fc9515a9819e0faf9b2ab1f485e7d49e10189fdb5b780a8fb779e62586d918b2
4b880328263a8d3318d26b36eaeeda4a2a87962b9b84637a5878a11d5a9df304
3d25ffc1e46e20a1805af68ab5a43c19897b5f3b5772e8435613f3ad3566acd3
9be520f02e0622bd4edb5849c9a2570505228efdb04bb5a1cd758762a261ab02
a674a0aac75570a779915ab71135c4018652df97a0f7161cb0edbb4a5af9303d
3f5236a82af731f886881c3e9abafe621e40b481b220f0b7639387860f795c16
4d7fef569b77cfb9745915b46ca00463029b924260115b8cf36feb1e076d15fa
36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
352f3584318b67778fd06d1d96962117d12cff0a5945b6ae8825e2c1bbdf8b8c
fc4b05b61482306c9dda17cf7af4e3730f952d7f4d8d97d58cb23d872f964717
e793d5cf45831918993bde7e78fd950fd5b5a0b9b7a583819a6d484c5ff8a34e
7d75e67add3d3ea32c9b6dbdc8f9debb87039dec036bb5c01140bb3dc4dea10a
a95f75dfe884a4503d2028aed2cc6415306476b5c08156e064952a5546e9b71d
8fb42af29238207bce70705bf46013f002e6a6e6cc739d910189388117c8fc41
cb445a7c30381ebf9801a9c515a200fda63e80e955e810aff43acb7c0823dabe
2495623296a5cea8686668a0b0ce1a9a1f7cadc639b36fc634933ebf7ba0c01a
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments