MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476
SHA3-384 hash: 0500275bd080fb32d8bef008cf001f3828eb4948c95e880616e090d66598958d221495798931848bd20c2a39ebb64ed8
SHA1 hash: e40fb8967ab3ecf50d1cf4b52c0124c81b7d86f6
MD5 hash: bbd9760541fb80a439fe1447ff6cdf58
humanhash: moon-hotel-colorado-eighteen
File name:bbd9760541fb80a439fe1447ff6cdf58.exe
Download: download sample
File size:432'132 bytes
First seen:2021-11-04 17:21:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fbe4cce31825940f582af9763f8c6fb6 (4 x RaccoonStealer, 2 x RedLineStealer, 2 x Smoke Loader)
ssdeep 12288:wmJ/eKgCO+BguIXK3pJ0Ba+QUfMf0FLsD9D5:wketFrg8ojUfMf0Fs
TLSH T11F94011173B2D431D5E32F744930ABB21A3A782326B4519F2BB7EB7E1E607D01A71726
File icon (PE):PE icon
dhash icon 480c1c4c4f590b14 (113 x Smoke Loader, 92 x RedLineStealer, 83 x Amadey)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bbd9760541fb80a439fe1447ff6cdf58.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-04 17:30:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/18fe0c7d-09bd-4a36-a4f8-e8d691a8ff6f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/202427/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/618416c08eec3805367e2cd8/reports/61535a4c-af2f-4149-a03b-25cc0a392887/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fd767cbd-1c10-4bad-90e9-5e5e9460d7d9
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/883421
Signature
C2 URLs / IPs found in malware configuration
Found detection on Joe Sandbox Cloud Basic with higher score
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 515855 Sample: j6hcIImE9T.exe Startdate: 04/11/2021 Architecture: WINDOWS Score: 76 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected Raccoon Stealer 2->26 28 Found detection on Joe Sandbox Cloud Basic with higher score 2->28 30 2 other signatures 2->30 7 j6hcIImE9T.exe 2->7         started        process3 signatures4 32 Injects a PE file into a foreign processes 7->32 10 j6hcIImE9T.exe 7->10         started        process5 process6 12 WerFault.exe 23 9 10->12         started        16 WerFault.exe 2 9 10->16         started        dnsIp7 22 192.168.2.1 unknown unknown 12->22 18 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 12->18 dropped 20 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->20 dropped file8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-04 17:22:07 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:b3ed1d79826001317754d88a62db05820a1ecd19 stealer
Link:
https://tria.ge/reports/211104-vxkdzshbc3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Raccoon
Unpacked files
SH256 hash:
25a4b6c6b34adf706411f6f6b91c46de7a80728964492e6eb11f2281e9678717
MD5 hash:
2f9b640b36cbd54b3c835289cc8075cd
SHA1 hash:
9e849ddf0cbb3291065a12408bc798c7cd7686d9
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/db8d338e-d18a-4764-a3c7-99a88e217a20/
Parent samples :
a972fe56cf0c891775ab81e23a90e553956c06623350fc91d4e7cdce3dfd3170
35405fdecc554572244c745e390644ae713070f0bf81b29b9b54f6a738cb0ea5
e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3
51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476
SH256 hash:
51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476
MD5 hash:
bbd9760541fb80a439fe1447ff6cdf58
SHA1 hash:
e40fb8967ab3ecf50d1cf4b52c0124c81b7d86f6
Link:
https://www.unpac.me/results/db8d338e-d18a-4764-a3c7-99a88e217a20/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/51785594b835/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1738451/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202427/

Comments