MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 500657f97a195fbaa311e49c124d98d2e1c39e248cac6f6a794a2d425bb3644f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara 2 Comments

SHA256 hash: 500657f97a195fbaa311e49c124d98d2e1c39e248cac6f6a794a2d425bb3644f
SHA3-384 hash: 584bf2ac719d46139e6bb368a83b6a39349fe3811fa9af82beae15cf1a17ffc2668116f00f0999ef3cdb8873d064c06d
SHA1 hash: c92c6c21134a4116edd83684a2e15d1b29a8c9fa
MD5 hash: ae5d3bbe200550c80f994334dd748dbf
humanhash: low-three-rugby-november
File name:ae5d3bbe200550c80f994334dd748dbf.exe
Download: download sample
Signature RaccoonStealer
File size:473'088 bytes
First seen:2020-06-30 13:32:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 69104843fd99359df270d11507bd145b
ssdeep 12288:5O7/ps2AaFTQRRiQ9JqVaVorglWVRa/xWCgM:9aQRR3oVaV4gLWCg
TLSH A9A4023037B1E073E05661B0893BF6B5952D78301A74A5F777982B3BAE727C04A39B19
Reporter @abuse_ch
Tags:exe RaccoonStealer


Mail intelligence No data
# of uploads 1
# of downloads 31
Origin country US US
CAPE Sandbox Detection:n/a
ClamAV PUA.Win.Downloader.Aiis-6803892-0
CERT.PL MWDB Detection:raccoon
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Kryptik
First seen:2020-06-30 08:25:05 UTC
AV detection:22 of 31 (70.97%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:raccoon
Tags:ransomware evasion spyware trojan discovery stealer family:raccoon
VirusTotal:Virustotal results 44.44%

Yara Signatures

Rule name:win_raccoon_a0
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe 500657f97a195fbaa311e49c124d98d2e1c39e248cac6f6a794a2d425bb3644f

(this sample)

Delivery method
Distributed via web download