MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e
SHA3-384 hash: a157342cb514bba9feef32fee4ecab50d40b3aac97c72e84ddab6677d3982abc57bf166336e840fdffaf6ead2df42e17
SHA1 hash: 24bb0cb7d283a2016efd11454df57395bb232dcc
MD5 hash: 81d43fc57818fe3cf0eade5972911ddb
humanhash: comet-bacon-king-wolfram
File name:81d43fc57818fe3cf0eade5972911ddb.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'177'088 bytes
First seen:2022-03-08 17:48:32 UTC
Last seen:2022-03-08 20:08:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 24576:KT7ifYNnrHgz3DsQNx9afWBJazxbkEaHNYK38QyTuUMG:c7kMHkTRkgwVbNacT/
TLSH T1B44533DA1680BE55C66FED34BB0F8815F22B6067B8D84843A117D6D7BCB584FD60E8B0
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/248423/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Sending an HTTP POST request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/62279ae5dfdfa8501c7b7019/reports/282b1c5f-b30b-4306-a760-8de1e952936e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1a80fcd-733c-4c55-833d-4e7c7f224800
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/952839
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2022-02-28 11:11:39 UTC
File Type:
PE (Exe)
AV detection:
34 of 42 (80.95%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqjshapvdl64iijdl2btyobu74s4aeaxg6vdun2vy5jf3mfq5kha._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220308-wdz6rschal/
Behaviour
Program crash
Unpacked files
SH256 hash:
3119ecf02abce64040df768f0ca6509d66948c6c0a8bd17fa403fc19717558f0
MD5 hash:
669ed9bf8c6b511f7d590c52fea5914b
SHA1 hash:
4af9c4e06f5c9f33f8da66e9f3ce0d5030037168
Link:
https://www.unpac.me/results/9102accb-daae-4cc6-a4f9-cb818ec6a7b2/
SH256 hash:
797439328861a8b35d5f7c51497e74c3bc4bb63f01f6ee665aa7b853c646675d
MD5 hash:
3458031042e302b4f7a64f68690aa882
SHA1 hash:
b29acbc0a9fba2d20e9417d74e019a708d3f5e17
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/9102accb-daae-4cc6-a4f9-cb818ec6a7b2/
SH256 hash:
4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e
MD5 hash:
81d43fc57818fe3cf0eade5972911ddb
SHA1 hash:
24bb0cb7d283a2016efd11454df57395bb232dcc
Link:
https://www.unpac.me/results/9102accb-daae-4cc6-a4f9-cb818ec6a7b2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 4c132381f51afdc421235e833c3834ff25c0101737aa3a3755c7525db0b0ea8e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2084545/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/248423/

Comments