MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4911fa1954ae21c905977d4a341a7984948cad6c2fd3269871d328386a0f3344. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4911fa1954ae21c905977d4a341a7984948cad6c2fd3269871d328386a0f3344
SHA3-384 hash: 7f3be9f3083311c29a2304004be2f0b0c33eaff88570b1d65c5426d95c78b06b79be2c3d28392fa1528119e860701142
SHA1 hash: 48b087b25dec9ed2574713d786e46c47bb156a3b
MD5 hash: ff47b14fae7af6baf17ccc151a0196c9
humanhash: oven-lamp-nine-nuts
File name:ff47b14fae7af6baf17ccc151a0196c9.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:603'136 bytes
First seen:2020-06-30 13:32:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 568bff351ee7e99ef7cf7a9adda85cab (3 x RaccoonStealer)
ssdeep 12288:XSje8ap9C8kVQ4fwCVueBju1Aq97h4DZtTczIF6Bofq+Z:v8arJOvVuqj4AeyzCi6iq+Z
TLSH A0D401163352C0B1D0216130A9A9DDB5226E7D72992435C327943F3FAEB26D15E3AF2F
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17231/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4911fa1954ae21c905977d4a341a7984948cad6c2fd3269871d328386a0f3344/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 13:34:08 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jei7ugkuvyq4sbmxpvfdigtzqskizllmf7jsngdr2mudq2qpgnca._file
Verdict:
unknown
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
ransomware stealer family:raccoon infostealer family:redline evasion spyware trojan discovery
Link:
https://tria.ge/reports/200630-elphxwfvbn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious use of SetThreadContext
Looks up external IP address via web service
Modifies system certificate store
Checks for installed software on the system
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Executes dropped EXE
Raccoon log file
RedLine
Raccoon
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 4911fa1954ae21c905977d4a341a7984948cad6c2fd3269871d328386a0f3344

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/401434/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/17231/

Comments