MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63
SHA3-384 hash:	0a0a1673ed9bf40211c0ccbccf58fa4236a91136ad9f7b60b26bf81a5bab045dcff6e0d9b8f22eec045f0926721fd603
SHA1 hash:	59c889f05d598d3e685246c195d0919f7e34e9da
MD5 hash:	f5d3acf1abb82d49828196e0a05a7919
humanhash:	edward-fanta-ceiling-jupiter
File name:	file
Download:	download sample
File size:	4'943'360 bytes
First seen:	2023-05-12 14:24:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6cdefe249a8219326764a2ce4cb9d655
ssdeep	98304:U/xntk4236gggHXeLyDY2uk79pmVH6xB+zKLZH+IR8L2fqjBIf:ItN2KlFcY47986+eL9NiHjW
TLSH	T18F36339E89DE11F0F6CE27B08527AACB3FF655924794C834FB842D07EA52A3550D6833
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4505/5/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	jstrosch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

261

Origin country :

US

Vendor Threat Intelligence

ANY.RUN raccoon

Malware family:

raccoon

Alert

Create hunting rule

ID:

1

File name:

Setup+.7z

Verdict:

Malicious activity

Analysis date:

2023-05-12 12:26:42 UTC

Tags:

raccoon recordbreaker trojan loader stealer

Link:

https://app.any.run/tasks/21a1b713-5e93-414f-9e28-5925046b240a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/388732/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Heur.RP.@FW@bSP6pFpi.14158.10566.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/83725/overview

Behaviour

MalwareBazaar

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed xpack

Link:

https://www.filescan.io/uploads/645e4c439d50210e70853eca/reports/4e7a4c57-b6ca-4100-8571-e68671b22e40/overview

Hybrid Analysis Trojan.RP.Generic

Verdict:

Malicious

Labled as:

Trojan.RP.Generic

Link:

https://www.hybrid-analysis.com/sample/3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4d1ccf35-2dd3-4fa7-8315-a203213b8b80

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1231702

Signature

Antivirus detection for dropped file

Creates autostart registry keys with suspicious names

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63/

ReversingLabs TitaniumCloud Win32.Spyware.Raccoonstealer

Threat name:

Win32.Spyware.Raccoonstealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-12 14:25:12 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

14 of 24 (58.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=htgmfszbd72qrwlxo7nwctuz6zulvtaa36iry2em4comrhrbrjrq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/230512-rrae2sdd66/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

1c256f494aa23a709639726177da7b2c678461d804c978967b5f6f607894571b

MD5 hash:

6bd4d34ac3a4697acd57390535bb23ae

SHA1 hash:

1260f2ca2e4a6206df42ac7af51571b43c7fe764

Link:

https://www.unpac.me/results/95b86735-43cf-4057-a96d-77937f461eea/

SH256 hash:

3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63

MD5 hash:

f5d3acf1abb82d49828196e0a05a7919

SHA1 hash:

59c889f05d598d3e685246c195d0919f7e34e9da

Link:

https://www.unpac.me/results/95b86735-43cf-4057-a96d-77937f461eea/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 3cccc2cb211ff508d97777db614e99f668bacc00df911c688ce09cc89e218a63

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/388732/

  

URLhaus

https://urlhaus.abuse.ch/url/2580611/