MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b
SHA3-384 hash: f9342b267655dbf290abf2307b2aaff8cf9762996870d5694c5852fb40d0c9d873f1848d3515108c6bda32f80715b9a9
SHA1 hash: 2857b958511356a4dea0bd8f69f33c7740f1f0c2
MD5 hash: 40c6d8628312ed409b085bcef173be21
humanhash: four-single-august-july
File name:40c6d8628312ed409b085bcef173be21.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:459'264 bytes
First seen:2021-03-18 18:57:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57a966ef19078645ef63d7fecb9ad598 (1 x RaccoonStealer, 1 x ArkeiStealer)
ssdeep 6144:LxZfnrTEa6WGmvmWx76v8ipMDZ2gEWag+sh5Tkgom2rwG5y0WswWRTIXFOMjFdNv:NnGktVDsE0ywwG5y0WjAIseyvE
Threatray 145 similar samples on MalwareBazaar
TLSH 9BA4F12132E2C033D19606B54C65C7B57A3AFCB15B245AC7BBD43BBA6E712C08B36752
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
40c6d8628312ed409b085bcef173be21.exe
Verdict:
Malicious activity
Analysis date:
2021-03-18 19:00:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c2d28072-6ef6-40ac-a530-a88995e7bea9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125514/
Detection(s):
Win.Malware.Ulise-9844930-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Creating a file
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Creating a file in the Program Files subdirectories
Searching for the window
Launching a process
Creating a window
Sending a TCP request to an infection source
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e52fbb1d-e27c-4d86-ae1a-c96abd86f6d7
Result
Threat name:
RMSRemoteAdmin Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/645343
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 371629 Sample: 1W2Ih2UesO.exe Startdate: 18/03/2021 Architecture: WINDOWS Score: 100 64 Multi AV Scanner detection for domain / URL 2->64 66 Multi AV Scanner detection for dropped file 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 3 other signatures 2->70 8 1W2Ih2UesO.exe 82 2->8         started        13 csdesvc.exe 2 2->13         started        process3 dnsIp4 58 telete.in 195.201.225.248, 443, 49718 HETZNER-ASDE Germany 8->58 60 finalcountdown.top 34.70.189.68, 443, 49720 GOOGLEUS United States 8->60 62 earthworkslandscaping.net 107.180.104.65, 443, 49728 AS-26496-GO-DADDY-COM-LLCUS United States 8->62 38 C:\Users\user\AppData\...\JWYhqzZoml.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 8->40 dropped 42 C:\Users\user\AppData\...\vcruntime140.dll, PE32 8->42 dropped 44 57 other files (none is malicious) 8->44 dropped 74 Detected unpacking (changes PE section rights) 8->74 76 Detected unpacking (overwrites its own PE header) 8->76 78 Tries to steal Mail credentials (via file access) 8->78 80 Tries to harvest and steal browser information (history, passwords, etc) 8->80 15 JWYhqzZoml.exe 7 29 8->15         started        18 cmd.exe 1 8->18         started        file5 signatures6 process7 file8 46 C:\Program Files\ConsolPR\csdesvc.exe, PE32 15->46 dropped 48 C:\Users\user\AppData\Local\Temp\Log99.xml, XML 15->48 dropped 50 C:\Users\user\AppData\Local\...\registry.dll, PE32 15->50 dropped 52 6 other files (none is malicious) 15->52 dropped 21 cmd.exe 1 15->21         started        23 csdesvc.exe 4 2 15->23         started        72 Uses schtasks.exe or at.exe to add and modify task schedules 18->72 26 conhost.exe 18->26         started        28 timeout.exe 1 18->28         started        signatures9 process10 dnsIp11 30 conhost.exe 21->30         started        32 schtasks.exe 1 21->32         started        34 schtasks.exe 1 21->34         started        36 schtasks.exe 1 21->36         started        54 95.142.46.159, 49733, 49736, 5655 VDSINA-ASRU Russian Federation 23->54 56 192.168.2.1 unknown unknown 23->56 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-03-18 16:29:36 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxrayu3vxh2ij46hms6ge4qtfgatnexgiqigb6qwotwoydytlbfq._file
Verdict:
malicious
Similar samples:
118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1
RaccoonStealer
5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
RaccoonStealer
6c8a5f43e07034d0545c60c137f96c6ab8da44cfd59a8654896c8f6c497aefad
RaccoonStealer
7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
RaccoonStealer
8f4d63fea00eca6d91147de6a10b7aae6069f164ef00d5986eff571249552dae
RaccoonStealer
8fba783fb93013344dd2182721a3b1a3fbc96b7b8c49ad4b364c63a0f2b11496
RaccoonStealer
b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18
RaccoonStealer
e5f575d9223be5a7a825f598e21b5ec4475ea6a9d58ad0e87932a57768908027
RaccoonStealer
ed20ff85f5df587140e0780e16a5eb28df94e1b6330c8256de39d94b5a772e83
RaccoonStealer
ee0400adcec67d05e4b6825df53ff7e5fb5d86680a65264976940239c322d9fb
RaccoonStealer
+ 135 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:717710bbeee6a2e362143dd219ef90d1878e3ffb discovery spyware stealer
Link:
https://tria.ge/reports/210318-y2x2xmqz82/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Raccoon
Unpacked files
SH256 hash:
7eae63c098ddd0f5cf45fb95675a66b2176c345e52db17edf855bda7047c9739
MD5 hash:
927184878074902e9686e5d7d97ce534
SHA1 hash:
f9f42657b43c9d8edc40f4265eeb1ad97f8f40b4
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/07cefcad-0ec7-4588-9365-8bab748046fe/
SH256 hash:
4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b
MD5 hash:
40c6d8628312ed409b085bcef173be21
SHA1 hash:
2857b958511356a4dea0bd8f69f33c7740f1f0c2
Link:
https://www.unpac.me/results/07cefcad-0ec7-4588-9365-8bab748046fe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cryptocoin_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20
Create hunting rule
Author:Florian Roth
Description:Detects XMRIG crypto coin miners
Reference:https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:susp_winsvc_upx
Create hunting rule
Author:SBousseaden
Description:broad hunt for any PE exporting ServiceMain API and upx packed
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_servhelper_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:XMRIG_Miner
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 4de20c5375b9f484f3c764bc62721329813692e6441060fa1674ecec0f13584b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1067835/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/125514/

Comments