MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d7c4746930fbadf4537612d2a50b95a6a442517ede98e97c7a1d67d334c5393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 5 File information Comments

SHA256 hash:	3d7c4746930fbadf4537612d2a50b95a6a442517ede98e97c7a1d67d334c5393
SHA3-384 hash:	d26cc32ac033d2e0dd115d797cb57dc24e3af50e6188841ce27d3f5c00ac9dca3fdd00460bbd63806b9d3955d9483c53
SHA1 hash:	05c8e8ef40de68d92b0e96cf540da116b50b15ca
MD5 hash:	68c3fe4f2e9578fc56d05caaf5fe265a
humanhash:	river-oregon-alabama-king
File name:	68c3fe4f2e9578fc56d05caaf5fe265a.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	571'392 bytes
First seen:	2021-05-28 15:20:05 UTC
Last seen:	2021-05-28 15:42:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cb971fcf399235e4e9a69622d3809fcc (6 x RaccoonStealer, 3 x Stop, 1 x CryptBot)
ssdeep	12288:NzB/8bMBR8FhPNbBwHVAChaaQ4AytnRda0vwtnsVhB3DZ:NzBiMBRz1IaJlRdFvwtnsVhB3DZ
Threatray	704 similar samples on MalwareBazaar
TLSH	14C4DF31AEA9C035E1F212B449B68279753A7DB17B3490CF62D43AEAD6347E4AC30753
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://45.153.230.32/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://45.153.230.32/	https://threatfox.abuse.ch/ioc/66258/

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

68c3fe4f2e9578fc56d05caaf5fe265a.exe

Verdict:

Malicious activity

Analysis date:

2021-05-28 16:39:43 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/93c2de33-d324-4a5f-914a-04acc17b1abe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/162986/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.36982908.31710.23003.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Connection attempt

Sending an HTTP POST request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/793921

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3d7c4746930fbadf4537612d2a50b95a6a442517ede98e97c7a1d67d334c5393/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2021-05-28 10:36:50 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hv6eorutb65n6rjxmewsuufzljveijix5xuy5f6huhlh2m2mkojq._file

Verdict:

malicious

RaccoonStealer

31130cb2c3ea64f2fa466d160d14540e745447c7d819bf875481547cc387c0f0

RaccoonStealer

4d05969ac846a1469caa6f9f83853bae9090b6aaeafe030075873fc7f1519a1e

RaccoonStealer

59562a7c28d4e461070e0cdd8d242981067cc646a23be65c137f19589579055e

RaccoonStealer

653d9d0ae06efd8ebb84a079bb7024cd5d2faa497c780ecc2b642f4c3b782cd3

RaccoonStealer

8e122077ba6cfee5a7da56a8083baf428153e7930e14e9c44925c17707fc226c

RaccoonStealer

8e98d227ab95b2d3e727ed670d1faa260157f6a595aa1026035606424f4509c9

RaccoonStealer

c50339202bebf620f50f539aa41632031d42ed3e640bbc210e50502bdb403856

RaccoonStealer

e7b76b39a0d1d7f1598ef84feb3184b4b207ba9c85c4acd81ebc9ada6ea67c60

RaccoonStealer

fe12a8772f3bb4fc8eb97e4a4a5470cbdaf44178281318a73a052eb43078bafb

RaccoonStealer

+ 694 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:7f6f1a71bebae5a113e0de986c62d83471cee5c8 stealer

Link:

https://tria.ge/reports/210528-vgz3ve7y6a/

Behaviour

Raccoon

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3d7c4746930fbadf4537612d2a50b95a6a442517ede98e97c7a1d67d334c5393

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator