MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ef1d1af7ceef7620a20f9603a01db21e6abd5ec3302698d1a320baa8813740a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ef1d1af7ceef7620a20f9603a01db21e6abd5ec3302698d1a320baa8813740a
SHA3-384 hash: 5057ed0a70f84701e13c9d48d944222189949137d3ddcb1e1004c1a17a0ed8dcd0bb5912fd521c98633ca019234ee41e
SHA1 hash: 327a7513fa9a76303537695f156c0df8fcac185d
MD5 hash: 7aa969fdffd0eb3a6d909fb1ef6a5a4c
humanhash: queen-king-october-juliet
File name:setup_x86_x64_install.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:4'359'137 bytes
First seen:2021-10-21 12:32:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:JfyG7RUZzWKznGD6OuLq1fHGS3cdXlOgpuEzMEvI6JNUxSLmx:JKiUtWKznGDqqNHdcLOgpWEvICCx
Threatray 640 similar samples on MalwareBazaar
TLSH T17E16332F6C344A9AC851173DE15FFA8D82E6F6954688779EB13C08CBBD63E610D84CB4
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter Anonymous
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199087/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
arkeistealer barys overlay packed
Link:
https://www.filescan.io/uploads/61715dff9a5a1e91c5cb6b99/reports/46f69491-9f2f-4338-ab8a-73585688cbb7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70b4a06a-ed50-4feb-ba68-7e3da98c949f
Result
Threat name:
Socelars
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/874550
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Disable Windows Defender real time protection (registry)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Socelars
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 506978 Sample: setup_x86_x64_install.exe Startdate: 21/10/2021 Architecture: WINDOWS Score: 100 62 208.95.112.1 TUT-ASUS United States 2->62 64 192.210.222.83 SERVER-MANIACA United States 2->64 66 13 other IPs or domains 2->66 78 Antivirus detection for URL or domain 2->78 80 Antivirus detection for dropped file 2->80 82 Multi AV Scanner detection for dropped file 2->82 84 13 other signatures 2->84 10 setup_x86_x64_install.exe 10 2->10         started        signatures3 process4 file5 40 C:\Users\user\AppData\...\setup_installer.exe, PE32 10->40 dropped 13 setup_installer.exe 22 10->13         started        process6 file7 42 C:\Users\user\AppData\...\setup_install.exe, PE32 13->42 dropped 44 C:\Users\user\...\Thu12ca1c119bc29.exe, PE32 13->44 dropped 46 C:\Users\user\...\Thu12b275ee70c7e913.exe, PE32 13->46 dropped 48 17 other files (8 malicious) 13->48 dropped 16 setup_install.exe 1 13->16         started        process8 dnsIp9 58 172.67.141.157 CLOUDFLARENETUS United States 16->58 60 127.0.0.1 unknown unknown 16->60 74 Adds a directory exclusion to Windows Defender 16->74 76 Disables Windows Defender (via service or powershell) 16->76 20 cmd.exe 1 16->20         started        22 cmd.exe 1 16->22         started        24 cmd.exe 1 16->24         started        27 3 other processes 16->27 signatures10 process11 signatures12 29 Thu123e05ebe43921.exe 20->29         started        34 Thu128b511c77e8c.exe 2 22->34         started        86 Adds a directory exclusion to Windows Defender 24->86 88 Disables Windows Defender (via service or powershell) 24->88 36 powershell.exe 23 24->36         started        38 powershell.exe 25 27->38         started        process13 dnsIp14 68 45.142.182.152 XSSERVERNL Germany 29->68 70 92.53.96.150 TIMEWEB-ASRU Russian Federation 29->70 72 5 other IPs or domains 29->72 50 C:\Users\user\AppData\...\wetsetup[1].exe, PE32 29->50 dropped 52 C:\Users\user\...\search_hyperfs_204[1].exe, PE32 29->52 dropped 54 C:\Users\user\AppData\...\Service[1].bmp, PE32 29->54 dropped 56 22 other files (5 malicious) 29->56 dropped 90 Tries to harvest and steal browser information (history, passwords, etc) 29->90 92 Disable Windows Defender real time protection (registry) 29->92 94 Antivirus detection for dropped file 34->94 96 Machine Learning detection for dropped file 34->96 98 Injects a PE file into a foreign processes 34->98 file15 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ef1d1af7ceef7620a20f9603a01db21e6abd5ec3302698d1a320baa8813740a/
Threat name:
Win32.Trojan.SmallDownloader
Create hunting rule
Status:
Malicious
First seen:
2021-10-21 12:33:04 UTC
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3y5dl34533wecra7fqduao3ehtkxvpmgmbgtdi2gif2vcatoqfa._file
Verdict:
unknown
Similar samples:
08dcc0cd8aa90a04708aab25c7de5b66d62b4218ef0c5d2654a24b3cef83e534
RaccoonStealer
3eaed1d4442ddd5cb4691a9cfd5aef6f374be2a3489b934d9043bb6e980a4841
RaccoonStealer
5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa
RaccoonStealer
80594c4ce01c53c6bcc472e88329cc23f51b0d3276c8f5b3a686033f8d2d452e
RaccoonStealer
91c43b63ed3549c521e4166ab7358e29ce19f8087c9053a8c6b6e4f17ddeb4c5
RaccoonStealer
941478d129063e71885f97791339a49c58c72991ccc8309734f12ef60aee5530
RaccoonStealer
9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806
RaccoonStealer
c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19
RaccoonStealer
f5f477d945634e37e1abca7c1390e03a7535005c9ff071a191f4d24274bdf075
RaccoonStealer
f92cfeb06515f18113a950d5bd569a23cdd85514ef509ccff6c5a4e9a08ca4c7
RaccoonStealer
+ 630 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:socelars family:vidar botnet:933 botnet:chris botnet:media21 aspackv2 backdoor discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/211021-pq8kcaace4/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
91.121.67.60:2151
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
194.104.136.5:46013
https://mas.to/@xeroxxx
Unpacked files
SH256 hash:
2010b113bce681120cbdbe50fd2c3393587d723b97d13a5777429570621bb339
MD5 hash:
ae22fdfdaf90dc3174ebe91333125e1e
SHA1 hash:
3a62fed1ee6e36ca58c3ec19d0a4ae9f9eb0e2b8
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
Parent samples :
40c4d06433a2db2e570b3302e01c5c2ebe51efb59473a5b08cb132ab6af8638b
6aa0d341cee633c2783960687c79d951bf270924df527ac4a99b6bfabf28d4ae
644ecdd263538e3f6da1689a78b77101dd86451afb376e785b33d1e7c9cd6f82
da3909ea1dfaa29dbd3f0ee74cbe629783826f97ae41e606f6db35890c59ec40
0cc82eba0f92824807acfec362e96c2933cb894e9a220194a3eae627e4007f26
b07be8360dd11e81f6830ae467bec71cb6058523b35947a399b7abdba985c9b5
273f433ba1cebfad830e52490a04ca744351fc46249285ff9514c6e1ceaaf99d
SH256 hash:
0cddd277bd0f1f5510538c0bd9b1cff4c5cd01c5caee8eb9d06b9baa88519052
MD5 hash:
6449aa2e023c5931ac91815ca54225ed
SHA1 hash:
65b5f4df2c28472469ddf924e6b0d0a61394c612
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
c3a7704676f51cf301a4250fd964a49b3eaaaf6e71f03a19e0fda9f86f41d1bd
MD5 hash:
5a7c94e21f1018ab0b7028cd7c6881f8
SHA1 hash:
f0dccd27a8f6c82507377d8db38a5e7da97ca568
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
27a9228747973ae9649e8717a2ff77916346560644e734ef2ed946f2767fb128
MD5 hash:
de1b3c28ea026c0ede620dd78199ddc5
SHA1 hash:
ee402371a36bff44c765323ccd8c7e4a56bc8d12
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
c24b5265f61bd42d6fbcb2c17da65edda32ba62abbc13e7e372d26b025f6d1b5
MD5 hash:
97b494d786fb1813a0c81cc41199f03f
SHA1 hash:
e20646ca3e9b8f9e6cd707173af0da89e0c0caeb
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
56a28c4d827dd29f2bc695a3b887ef801bda0d201b03afec7d2054f23af8ac5f
MD5 hash:
5b97d372e4d548b2197662551c208d32
SHA1 hash:
a66cc37becf755cf38731ff2b06c51726d68b93b
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
da7af5ed7e6ef9be519c5b3418286e97c7a79784e3f111d136e3ef1630af21d1
MD5 hash:
3e7496e5a607510badd8ded51c439e78
SHA1 hash:
a3e821169b55808d7bff9531384433865e061c60
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
29affef4a9eb8446af1c5e00435450cf59d86f0b6fa6e2ef8c449d006134a043
MD5 hash:
acfa717c2559dd15e5d8ca78ac3de196
SHA1 hash:
7756a6813cda3f8bbb9f6278ddc7d0476e7d500a
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
58a9f013f8d3186029a0207f43bb48df1b04351187788a82538aedae7293a856
MD5 hash:
2f3629dd0a9ec4df3c81f29f259f114e
SHA1 hash:
2880883083f22b3c1c9fa1ceed3eaae4672e6f7b
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
174f4f8146a8998395b38774f52063130304ab214257d10badc37464578c8c1d
MD5 hash:
7dc5f09dde69421bd8581b40d994ccd7
SHA1 hash:
23788ae65ec05a9e542636c6c4e1d9d6be26d05c
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
3ffdaa1515622897c84111ab4180de09aadd03674935555270a2789625f7e513
MD5 hash:
9074b165bc9d453e37516a2558af6c9b
SHA1 hash:
11db0a256a502aa87d5491438775922a34fb9aa8
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
2523266dcefe22c4e1cef29c7622c171ebe8c90e4c69657a95e0e74022452523
MD5 hash:
993697b74a685ee3fbd664a24520cb82
SHA1 hash:
104a8d9a90728fe3ce42d3a5e9d3eb7996ad37fd
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
9a33f847afb2ac3e016d8b159a91f95693664c2b8a07e879cab9879578e77154
MD5 hash:
8f687e42b6c5975f51e0f39b9018297a
SHA1 hash:
0ccbcf0fd61fa9e282a6a9cad8a6788c76b4e126
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
5f0b8203aa3721553b6de2f1a4c2243ad6a324f8817cf8a17e6f0968e16e1753
MD5 hash:
b840862085ee24884ffe5052cf8d8438
SHA1 hash:
9417720327bf821fb5c88b09f9d7bcc6ccf09a8e
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
76e14134a7a8d89f224790e14f5a4e42e1700d62be25ca90e0f3028950e88412
MD5 hash:
b23c671ccff85e3354986b3e05fad8f8
SHA1 hash:
bb9f223669f75e9ba66226556c79761a7c8df165
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
7a9174b7ea73367dc8a37a4a6a90842662dd69c44ade96356b1d345584296da3
MD5 hash:
cf5cc1bf6fa5469a6196a1df185af6f5
SHA1 hash:
1bfbfed102ccced50c6843b3fc6abee2a76570b2
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
474941a5e7bc93a93a1d68b68147c35b863ab6613ef197d10e8ed6954695dc5c
MD5 hash:
0f358ec55cdbc00528870bc8406f726c
SHA1 hash:
3ef738cb46a6c2911154ae72756a2df1d142aa75
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
3714a59ab1d7c0fdd36fca10fb540eac086a07ac21e0263f9f09df36dfcb7550
MD5 hash:
604a6cd285c38b1fdd5d7b707126075c
SHA1 hash:
667351c5bf3c5dcd87bed99d93b7b38d52a568dd
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
57357e1d304ed1c4db3d22dbbd6a01327237d1fad37437db58f0a7d97a3d7ba3
MD5 hash:
42c09e2ff1923e01e6b465436b1d176f
SHA1 hash:
6fc4b58ff71392865812ba14a6b469ddec5df7d4
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
Parent samples :
644ecdd263538e3f6da1689a78b77101dd86451afb376e785b33d1e7c9cd6f82
0cc82eba0f92824807acfec362e96c2933cb894e9a220194a3eae627e4007f26
b07be8360dd11e81f6830ae467bec71cb6058523b35947a399b7abdba985c9b5
273f433ba1cebfad830e52490a04ca744351fc46249285ff9514c6e1ceaaf99d
SH256 hash:
613cb211578f12d2a9f1d9c4880678cddf98d9d188dc12b515e66a889a382b54
MD5 hash:
710dd2df730c1a1eee250d872f364d89
SHA1 hash:
1c18b6f83461a08ba8e82d9ee58231ce25578bce
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
510e67b277c1d0537a02881445b768aab96a2de483d0cd856e3c27415bb32afc
MD5 hash:
78f51ea6d5c92e265d554ee059bf21b0
SHA1 hash:
2035e88ec90565c77114797c2333f39d39e913ee
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
371975abbc8ffbeaa9b0918ab7c4b98a3484a2766fa313e7798c9ece070cf37c
MD5 hash:
2d8e2fac929328f0a010b3487534f492
SHA1 hash:
1901c65a8944af91e13eff5d6f2a0a793fbb4c1f
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
SH256 hash:
3ef1d1af7ceef7620a20f9603a01db21e6abd5ec3302698d1a320baa8813740a
MD5 hash:
7aa969fdffd0eb3a6d909fb1ef6a5a4c
SHA1 hash:
327a7513fa9a76303537695f156c0df8fcac185d
Link:
https://www.unpac.me/results/117b863a-f6bb-4e46-8936-e6f2a5b5b610/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ef1d1af7ceef7620a20f9603a01db21e6abd5ec3302698d1a320baa8813740a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/199087/

Comments