MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA File information Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: 50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0
SHA3-384 hash: c9daa92e1810ee2938113add4e7e6d5656b73fbd43190b1ea1e3bd14b52b875ed9bb87cd2dea64f1f119e7a820e8eb8b
SHA1 hash: a04fe7f0944c051d9eb60a53e321bae5ad139912
MD5 hash: c94a5671588abb64eab63db753ff3dde
humanhash: zebra-michigan-early-jig
File name:c94a5671588abb64eab63db753ff3dde.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:319'488 bytes
First seen:2022-01-14 09:46:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 80fec6fca6f81033220e34b44810dbfd (3 x RaccoonStealer)
ssdeep 6144:RnueuQuWjRKidSSUeE+XaiDiGvDvi00bbVzTN119N7ZM69A:R1uejdSSUcX3HrvEbRN11z6
Threatray 32 similar samples on MalwareBazaar
TLSH T17264AE10B7A0C036F5B722F846B9936DB93E3EA1573454CB12D52AEE4A356E0EC3171B
File icon (PE):PE icon
dhash icon 2dec137839939b91 (4 x RedLineStealer, 2 x DanaBot, 2 x ArkeiStealer)
Reporter @abuse_ch
Tags:exe RaccoonStealer


Twitter
@abuse_ch
RaccoonStealer C2:
65.108.104.175:1193

Intelligence

File Origin
# of uploads :
1
# of downloads :
309
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c94a5671588abb64eab63db753ff3dde.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-14 10:08:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6101a3a7-b480-49cf-8f28-53ac51d4442b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219285/
Detection(s):
Win.Packed.Tofsee-9935687-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
DNS request
Searching for synchronization primitives
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4178/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware tofsee
Link:
https://www.filescan.io/uploads/61e1469de997359713eb84bc/reports/9c6f1aea-4200-4309-9cb6-f85659bd5236/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e8cebae9-a07c-490c-a1af-e7a693079db5
Result
Threat name:
Amadey Raccoon RedLine SmokeLoader Tofse
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/920643
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking computer name)
Found evasive API chain (may stop execution after checking locale)
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has nameless sections
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 553121 Sample: urMpgNNXPM.exe Startdate: 14/01/2022 Architecture: WINDOWS Score: 100 95 185.215.113.35, 49894, 49895, 49896 WHOLESALECONNECTIONSNL Portugal 2->95 97 transfer.sh 2->97 99 microsoft-com.mail.protection.outlook.com 2->99 129 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->129 131 Multi AV Scanner detection for domain / URL 2->131 133 Antivirus detection for URL or domain 2->133 135 20 other signatures 2->135 11 urMpgNNXPM.exe 2->11         started        14 mtkthtmd.exe 2->14         started        16 brgebic 2->16         started        18 6 other processes 2->18 signatures3 process4 dnsIp5 171 Contains functionality to inject code into remote processes 11->171 173 Injects a PE file into a foreign processes 11->173 21 urMpgNNXPM.exe 11->21         started        175 Detected unpacking (changes PE section rights) 14->175 177 Detected unpacking (overwrites its own PE header) 14->177 179 Writes to foreign memory regions 14->179 181 Allocates memory in foreign processes 14->181 24 svchost.exe 14->24         started        27 brgebic 16->27         started        101 127.0.0.1 unknown unknown 18->101 29 WerFault.exe 18->29         started        signatures6 process7 dnsIp8 161 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->161 163 Maps a DLL or memory area into another process 21->163 165 Checks if the current machine is a virtual machine (disk enumeration) 21->165 31 explorer.exe 10 21->31 injected 105 microsoft-com.mail.protection.outlook.com 104.47.54.36, 25, 49814 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 24->105 107 patmushta.info 94.142.143.116, 443, 49824, 49901 IHOR-ASRU Russian Federation 24->107 167 System process connects to network (likely due to code injection or exploit) 24->167 169 Creates a thread in another existing process (thread injection) 27->169 signatures9 process10 dnsIp11 115 185.233.81.115, 443, 49773 SUPERSERVERSDATACENTERRU Russian Federation 31->115 117 188.166.28.199, 80 DIGITALOCEAN-ASNUS Netherlands 31->117 119 10 other IPs or domains 31->119 73 C:\Users\user\AppData\Roaming\brgebic, PE32 31->73 dropped 75 C:\Users\user\AppData\Local\Temp\F9FC.exe, PE32 31->75 dropped 77 C:\Users\user\AppData\Local\TempB67.exe, PE32 31->77 dropped 79 9 other malicious files 31->79 dropped 121 System process connects to network (likely due to code injection or exploit) 31->121 123 Benign windows process drops PE files 31->123 125 Deletes itself after installation 31->125 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 31->127 36 8D62.exe 31->36         started        39 F9FC.exe 2 31->39         started        42 6DF6.exe 31->42         started        45 4 other processes 31->45 file12 signatures13 process14 dnsIp15 137 Detected unpacking (changes PE section rights) 36->137 139 Detected unpacking (overwrites its own PE header) 36->139 141 Found evasive API chain (may stop execution after checking mutex) 36->141 159 4 other signatures 36->159 81 C:\Users\user\AppData\Local\...\mtkthtmd.exe, PE32 39->81 dropped 143 Machine Learning detection for dropped file 39->143 145 Uses netsh to modify the Windows network and firewall settings 39->145 147 Modifies the windows firewall 39->147 47 cmd.exe 1 39->47         started        50 cmd.exe 2 39->50         started        52 sc.exe 1 39->52         started        59 3 other processes 39->59 109 185.163.45.70, 80 MIVOCLOUDMD Moldova Republic of 42->109 111 185.163.204.22, 49888, 80 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE Germany 42->111 113 185.163.204.24, 49889, 80 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE Germany 42->113 83 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 42->83 dropped 85 C:\Users\user\AppData\...\vcruntime140.dll, PE32 42->85 dropped 87 C:\Users\user\AppData\...\ucrtbase.dll, PE32 42->87 dropped 91 11 other files (none is malicious) 42->91 dropped 149 Tries to steal Mail credentials (via file / registry access) 42->149 151 Tries to harvest and steal browser information (history, passwords, etc) 42->151 89 C:\Users\user\AppData\Local\...\mjlooy.exe, PE32 45->89 dropped 153 Antivirus detection for dropped file 45->153 155 Tries to detect virtualization through RDTSC time measurements 45->155 157 Injects a PE file into a foreign processes 45->157 54 4BB.exe 45->54         started        57 WerFault.exe 23 9 45->57         started        file16 signatures17 process18 dnsIp19 93 C:\Windows\SysWOW64\...\mtkthtmd.exe (copy), PE32 47->93 dropped 61 conhost.exe 47->61         started        63 conhost.exe 50->63         started        65 conhost.exe 52->65         started        103 86.107.197.138, 38133, 49902 MOD-EUNL Romania 54->103 67 conhost.exe 59->67         started        69 conhost.exe 59->69         started        71 conhost.exe 59->71         started        file20 process21
Detection:
n/a
Create hunting rule
Link:
https://mwdb.cert.pl/sample/50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0/
Threat name:
Win32.Trojan.Krypter
Create hunting rule
Status:
Malicious
First seen:
2022-01-14 09:47:12 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://www.spamhaus.org/query/hash/kc7olqi5hecrk6vdvjdbxhngttafzegxjazq5gbsjtbwqflbbpaa._file
Verdict:
malicious
Similar samples:
08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec
RaccoonStealer
1b8192ec7f52e9056f5f2c83f0a9c56c83469575fded613e6ae7c1f3505a3c1d
RaccoonStealer
1cf27ab77a771ff942b1e2947856844fbab4991cf87aca618968445b5c5d706d
RaccoonStealer
4a74dbaaacb20b26d7237b74ced5bd105b0ff3e2eb3ece3eba7bb93bf224b853
RaccoonStealer
55e13deee3f281585865313131f946195f683ea1926e25492e3dd7c0b87d9bac
RaccoonStealer
6c02cd3294f998736222c255ddd163b9d5e72dfbf3492bfdd43519a46ed609de
RaccoonStealer
b50e88d7d4ed87c10772d463b0649bb735a426230576e4b3ee8fd0b67f0dbc44
RaccoonStealer
c8fe81088b2caa9df35d92a588fb266a145c95b81b5c66d5bfe181fa73b17d82
RaccoonStealer
d0f8a2be536ca434da7734bd318d2a88ea5005f47d518c30ff611185f42c3701
RaccoonStealer
+ 22 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:arkei family:raccoon family:smokeloader family:tofsee family:xmrig botnet:default backdoor collection discovery evasion miner persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/220114-lr9bgsfgaq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Arkei Stealer Payload
XMRig Miner Payload
Amadey
Arkei
Raccoon
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Windows security bypass
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
xmrig
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
http://file-file-host4.com/tratata.php
patmushta.info
parubey.info
185.215.113.35/d2VxjasuwS/index.php
Unpacked files
SH256 hash:
788f723ebfe0110232b52ee15345acc5f74a53ea45e5f422dc5ce2eb5833fadc
MD5 hash:
198ff357daf4345c9fc869616b139381
SHA1 hash:
24c9899b296cf004e400b77e72b89f42bb726f37
Link:
https://www.unpac.me/results/f02a1990-7544-4451-b49a-b3eaead4da13/
SH256 hash:
50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0
MD5 hash:
c94a5671588abb64eab63db753ff3dde
SHA1 hash:
a04fe7f0944c051d9eb60a53e321bae5ad139912
Link:
https://www.unpac.me/results/f02a1990-7544-4451-b49a-b3eaead4da13/
AV coverage:
35.29%
AV detections:
24 / 68
Link:
https://www.virustotal.com/gui/file/50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0/detection/f-50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0-1642154761
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.108.104.175:1193 https://threatfox.abuse.ch/ioc/295071

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 50bee5c11d3905157aa3aa461b9da69cc05c90d748330e98324cc36815610bc0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1970142/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/219285/

Comments