MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e314e5b5221f918297e6cd98555ab214dceb012192d9400ca406193fac1dd40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	3e314e5b5221f918297e6cd98555ab214dceb012192d9400ca406193fac1dd40
SHA3-384 hash:	5e5440aa485f2965a88ff4461e4f55183aa3835e31eaf0cd5d8ee057dd7cf7b6bce1aab0313d1957a9c0724c69bb92d6
SHA1 hash:	6433a40c3ffcaab4542feac529ff6b6be5ee984d
MD5 hash:	3391a780d274fc63970320989941849c
humanhash:	mexico-red-maine-thirteen
File name:	SecuriteInfo.com.Variant.Lazy.256797.23345.3695
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	108'032 bytes
First seen:	2023-01-04 23:31:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	89766042e29aed5fce63c7340618b000 (6 x RecordBreaker, 3 x RaccoonStealer)
ssdeep	1536:d0jcjzCB6WeKjhKY/hINnAsmLps3K6iAGuSayJCPieRMRGpq5:QcjzCB6WfhK4IULps3K6RbSlCPiSE75
Threatray	237 similar samples on MalwareBazaar
TLSH	T14DB37291D8D6BC12C69100315DC7F773A72DAE392CF4E80FA2985EF07EA40657E5E982
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	SecuriteInfoCom
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

248

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

Install.exe

Verdict:

Malicious activity

Analysis date:

2023-01-04 23:19:00 UTC

Tags:

evasion opendir loader trojan amadey rat redline

Link:

https://app.any.run/tasks/f0bdd73a-4cf8-48f7-a0de-769b6f89e8a4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/349504/

Detection(s):

SecuriteInfo.com.Variant.Lazy.256797.23345.3695.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending a custom TCP request

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63b60c75b9b1c1737520689f/reports/7d861465-84f4-4822-8df7-5afdd6812702/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5902cb5b-84fb-4d0f-b09b-cad9a3d8bcbf

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1145383

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3e314e5b5221f918297e6cd98555ab214dceb012192d9400ca406193fac1dd40/

Threat name:

Win32.Trojan.Phonzy

Status:

Malicious

First seen:

2023-01-03 20:51:58 UTC

File Type:

PE (Exe)

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hyyu4w2seh4rqkl6ntmykvnlefg45masdewziagkibqzh6wb3vaa._file

Verdict:

malicious

Label(s):

raccoon

RaccoonStealer

14d0ab048470cf65ec844ce0a841204c8120c190a5838bc5bcdb85a1ea9f56fa

RaccoonStealer

21ed24d2d6935439ae3e18b6778d8e1c6387cfbc162f0a047f4df9a00d87fbc9

RaccoonStealer

25c17fe456e4f3307e03f8fecb0154fcd4d66374922a4d169b30549f80501958

RaccoonStealer

3cf79fc23f11a3083159b0a8b5b0c04068ccb93715a1f82e360ea31608a300bf

RaccoonStealer

3e1fbbd273800929e5d4a0d80655a43b262da68eb415141c346b7feb97dc6316

RaccoonStealer

5fa1c3ddf64efe1a1c7482987bcd03b32bdbebbb5ca7adeca2f5615d24790811

RaccoonStealer

712a5c955bd61408454fdb715f46dbd0edceb328e61ad1feb84939b6c69fb65c

RaccoonStealer

d91a27a04ac9e4fc3ddfbb37372f0587cb62b8be0ec0cf5afc52a2c4c8ca4ee5

RaccoonStealer

e70e3bab6f90e79016bd67a9c934fd9a49100ac5e9a265ee3f5d4f3c1a9ab820

RaccoonStealer

+ 227 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/230104-3h9z4aaa63/

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/c6e454d1-7005-4a11-a387-594383ba57cb

Unpacked files

SH256 hash:

3e314e5b5221f918297e6cd98555ab214dceb012192d9400ca406193fac1dd40

MD5 hash:

3391a780d274fc63970320989941849c

SHA1 hash:

6433a40c3ffcaab4542feac529ff6b6be5ee984d

Link:

https://www.unpac.me/results/6be49b35-e47c-43ac-ad0e-f2dcdbecd7d2/

Malware family:

RecordBreaker

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3e314e5b5221/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3e314e5b5221f918297e6cd98555ab214dceb012192d9400ca406193fac1dd40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.