MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4
SHA3-384 hash: c2b74afe97b9b3060bd9314e7d75dfab9a8eeea9e7af10f494a727fb82f7e872f7da50e80bd4de07ff3eaf913b923024
SHA1 hash: d386076e629500ab7bdd3c8123c6e222d0c939c2
MD5 hash: 0f6f0d510e9aa359641ec9a5133ee698
humanhash: magazine-carolina-pluto-hotel
File name:0f6f0d510e9aa359641ec9a5133ee698.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'149'359 bytes
First seen:2021-01-31 07:48:41 UTC
Last seen:2021-01-31 09:58:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 061ddbe41a69b3676edebf6a92a5f06a (4 x RaccoonStealer, 1 x RemcosRAT)
ssdeep 24576:QQCemrx/IW4tfPmeuBO4GPDRwrbrtJerRMYEa0wz7UOX1hIVeooe:QQCemrxw7IGPDRw3r7fYEa0wMOlhIVeQ
Threatray 413 similar samples on MalwareBazaar
TLSH 0B35F113AA254903E5060E705EF287F6277DFC537A425E1FB748FA180DB2B862CD167A
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0f6f0d510e9aa359641ec9a5133ee698.exe
Verdict:
Malicious activity
Analysis date:
2021-01-31 07:53:00 UTC
Tags:
trojan rat azorult stealer vidar loader remcos
Link:
https://app.any.run/tasks/fb37e480-0e58-4914-97ba-7e9c4f4eb6a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114927/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
DNS request
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Creating a file
Deleting a recently created file
Reading critical registry keys
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Replacing files
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Threat name:
AsyncRAT Azorult Raccoon
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/594730
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
PE file contains section with special chars
PE file has nameless sections
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 346403 Sample: e7zQwqIDCO.exe Startdate: 31/01/2021 Architecture: WINDOWS Score: 100 116 icacxndo.ac.ug 2->116 118 brudfascaqezd.ac.ug 2->118 120 2 other IPs or domains 2->120 138 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->138 140 Multi AV Scanner detection for domain / URL 2->140 142 Malicious sample detected (through community Yara rule) 2->142 144 15 other signatures 2->144 11 e7zQwqIDCO.exe 16 2->11         started        15 cmd.exe 2->15         started        17 taskkill.exe 2->17         started        signatures3 process4 file5 110 C:\Users\user\AppData\Roaming\ZBVetrcxv.exe, PE32 11->110 dropped 112 C:\Users\user\AppData\...\SghtyrFbvr.exe, PE32 11->112 dropped 168 Detected unpacking (changes PE section rights) 11->168 170 Detected unpacking (overwrites its own PE header) 11->170 172 Maps a DLL or memory area into another process 11->172 19 ZBVetrcxv.exe 4 11->19         started        22 e7zQwqIDCO.exe 87 11->22         started        26 SghtyrFbvr.exe 4 11->26         started        28 2qlghqsd.exe 15->28         started        30 conhost.exe 15->30         started        32 conhost.exe 17->32         started        signatures6 process7 dnsIp8 146 Detected unpacking (changes PE section rights) 19->146 148 Maps a DLL or memory area into another process 19->148 34 ZBVetrcxv.exe 71 19->34         started        130 telete.in 195.201.225.248, 443, 49723 HETZNER-ASDE Germany 22->130 132 mynameisalfred.top 104.21.15.91, 443, 49725 CLOUDFLARENETUS United States 22->132 102 C:\Users\user\AppData\...\Oofd282hoQ.exe, PE32 22->102 dropped 104 C:\Users\user\AppData\...\olWho3ZLO0.exe, PE32 22->104 dropped 106 C:\Users\user\AppData\...\9NrMFOsgiJ.exe, PE32 22->106 dropped 108 60 other files (none is malicious) 22->108 dropped 150 Tries to steal Mail credentials (via file access) 22->150 39 Oofd282hoQ.exe 22->39         started        41 9NrMFOsgiJ.exe 22->41         started        43 5rHV0CX4Bq.exe 22->43         started        49 2 other processes 22->49 152 Detected unpacking (overwrites its own PE header) 26->152 45 SghtyrFbvr.exe 188 26->45         started        47 powershell.exe 28->47         started        file9 signatures10 process11 dnsIp12 122 dancedance.ac.ug 34->122 84 C:\Users\user\AppData\Local\Temp\ac.exe, PE32 34->84 dropped 86 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 34->86 dropped 88 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 34->88 dropped 98 49 other files (none is malicious) 34->98 dropped 156 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->156 158 Tries to steal Instant Messenger accounts or passwords 34->158 160 Tries to steal Mail credentials (via file access) 34->160 166 3 other signatures 34->166 51 ac.exe 34->51         started        90 C:\Users\user\AppData\Local\...\tmpC0D6.tmp, XML 39->90 dropped 92 C:\Users\user\AppData\...\ZgJrFIxxlXT.exe, PE32 39->92 dropped 162 Injects a PE file into a foreign processes 39->162 54 Oofd282hoQ.exe 39->54         started        57 schtasks.exe 39->57         started        59 9NrMFOsgiJ.exe 41->59         started        62 5rHV0CX4Bq.exe 43->62         started        124 marianne.ac.ug 185.215.113.77, 49724, 49726, 49730 WHOLESALECONNECTIONSNL Portugal 45->124 126 192.168.2.1 unknown unknown 45->126 94 C:\ProgramData\vcruntime140.dll, PE32 45->94 dropped 96 C:\ProgramData\sqlite3.dll, PE32 45->96 dropped 100 5 other files (none is malicious) 45->100 dropped 164 Tries to steal Crypto Currency Wallets 45->164 64 cmd.exe 45->64         started        66 conhost.exe 47->66         started        128 cdn.discordapp.com 162.159.130.233, 443, 49733 CLOUDFLARENETUS United States 49->128 68 conhost.exe 49->68         started        70 timeout.exe 49->70         started        file13 signatures14 process15 dnsIp16 154 Injects a PE file into a foreign processes 51->154 134 icacxndo.ac.ug 54->134 136 icando.ug 91.193.75.94, 49742, 49743, 49749 DAVID_CRAIGGG Serbia 54->136 72 conhost.exe 57->72         started        114 C:\Windows\Temp\2qlghqsd.exe, PE32 59->114 dropped 74 cmstp.exe 59->74         started        76 powershell.exe 62->76         started        78 conhost.exe 64->78         started        80 taskkill.exe 64->80         started        file17 signatures18 process19 process20 82 conhost.exe 76->82         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-31 07:49:08 UTC
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ji633htwxx3bnb5pwbbrhmwns2bjqxy4kxdc6vgz6okefrjyxlsa._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
azorult
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
50835c6c6d8bd3415be9849c272876e863b792c035f052a03449aefb646a600a
RaccoonStealer
60152e8f49b376387ea78e05be97894b52c0dc862a9906248b12a441e840ee2d
RaccoonStealer
ac8a0b325adca9cc88fc6ee32c912024adfe5228024712e1c757183c51260d16
RaccoonStealer
b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
RaccoonStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
RaccoonStealer
c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
RaccoonStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
RaccoonStealer
ebe987a5cb9ad1bcc702dc23a1baccbc8e7200ce2c7a2d4bb2d7c91110abf48b
RaccoonStealer
+ 403 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:oski family:raccoon family:remcos discovery evasion infostealer persistence ransomware rat spyware stealer trojan
Link:
https://tria.ge/reports/210131-l39gwv5gtx/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Async RAT payload
AsyncRat
Azorult
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
Oski
Raccoon
Remcos
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
nothinglike.ac.ug:6969
brudfascaqezd.ac.ug:6969
icando.ug:6970
icacxndo.ac.ug:6970
Unpacked files
SH256 hash:
4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4
MD5 hash:
0f6f0d510e9aa359641ec9a5133ee698
SHA1 hash:
d386076e629500ab7bdd3c8123c6e222d0c939c2
Link:
https://www.unpac.me/results/0dc7dfa8-7cac-4bcd-9221-1d3962738a50/
SH256 hash:
b89b045a653bf1c3ac354d87a08e83e8d2da8c74e3b917cc3487295b08a2b82c
MD5 hash:
4756c68ea565a2c088f819ed586e5228
SHA1 hash:
bf261eac9e18cfc88f9a0341a61ffa7e43f2758c
Link:
https://www.unpac.me/results/0dc7dfa8-7cac-4bcd-9221-1d3962738a50/
SH256 hash:
733b7ec7940350b45e1e56ca0e4eeda6ca7d12d40656979f71285a0e4ea49136
MD5 hash:
ccc7b491274deae95226f332132576cb
SHA1 hash:
2c9e2bfdc2960a167fa75702c62d8deaa543f8c9
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/0dc7dfa8-7cac-4bcd-9221-1d3962738a50/
SH256 hash:
cb3ad0b3c98835d4883d877934092d6bcd7eab796f11a8e9f03930af15fa29ec
MD5 hash:
510249be92f6ebd4f4bfc8886bf854b8
SHA1 hash:
f2cc6d8c2e3ca94d41984fabeaad2598eda82735
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/0dc7dfa8-7cac-4bcd-9221-1d3962738a50/
SH256 hash:
df009051d437c4d7953c89e900815983381cc9651f32636ef96a0c2f083353fc
MD5 hash:
694f085b5786752516a9d1638a71f47e
SHA1 hash:
34681876de36b3f7215c03a4c1f0b4481868dfec
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/0dc7dfa8-7cac-4bcd-9221-1d3962738a50/
Parent samples :
15226ca74b25627920e79683582ea7f46263e461585ca3f0d7af5cae7b6b8308
29c2bac557266c71d9ac29741361c48e0c2a9b2196dc10a8961a98d79fe3ec05
69281664db9f7088a1cdfbf5b3468170bdbeadeb3ce9f4db3ef114ef8828e870
4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar infostealer variants
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/584190/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/114927/

Comments