MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2
SHA3-384 hash: 93bbaad7e89b45f02e4dcf42be27552bcdb39f71f6dd8ea8d03a1b49dc7d9486b166a3c21890a6191b79484786168566
SHA1 hash: c56cbb5d8ba97932d49146183ecc31045c80b068
MD5 hash: f34cac12ad52c250c2381327d5f5939b
humanhash: shade-high-bluebird-pasta
File name:f34cac12ad52c250c2381327d5f5939b.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:518'624 bytes
First seen:2021-09-22 18:25:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e29fdb264def7dda465a7a289be86662 (2 x RaccoonStealer, 1 x CoinMiner, 1 x RedLineStealer)
ssdeep 12288:wtbvbEltHkeWlPTG1H0oSI4palupg6QiNeh:w2ltHkhd61F44+JNC
Threatray 3'189 similar samples on MalwareBazaar
TLSH T19FB401D279F0D870C8961D789569CAB4267AFC71C570808B73B8376E2F712B3623A746
File icon (PE):PE icon
dhash icon 71cc9696b28ef871 (1 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.163.45.42/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.45.42/ https://threatfox.abuse.ch/ioc/224597/

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f34cac12ad52c250c2381327d5f5939b.exe
Verdict:
Malicious activity
Analysis date:
2021-09-22 18:27:51 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/bfdef0a7-a5aa-497d-a2bd-35110a2cd08b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190404/
Detection(s):
Win.Packed.Generic-9892828-0
Create hunting rule

Win.Packed.Generic-9892879-0
Create hunting rule

Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac4f1d14-31d9-45a2-bc4b-a9659c515021
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/855891
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-09-18 15:58:08 UTC
AV detection:
37 of 45 (82.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktvsp2lwzky3r3zromkjx4pnmocwf7k25tmq2ynnsyzkz2nyvpza._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
03d23ad7ab07c264aa23794c51236157641a98f8a6b40dc063e3403e831b967b
RaccoonStealer
091ee9a9dd7f5501d96e04c9d7cfda6bb6cf3cdcb308f2ef293c123f675d56a7
RaccoonStealer
19e1615b05d89f0268b47c11407aa8023a65d704dadba3660557d81dd3e507cb
RaccoonStealer
3c2557c292a2e3a61a85cd44f45f8f3998fd16db3e5e523353eac61a879f726a
RaccoonStealer
694c879e26f27610bc40ea419bea615dacb1e3a946a2c843f22af724623d1704
RaccoonStealer
80f0607db29814c032dd81fabf31e3c7e1134c5cf9fde17d639556381d5299d3
RaccoonStealer
8544f85e040d93d38c12d4c096607ee4eabdd17feeec444d0b9d4b633ba3d193
RaccoonStealer
88bea616209dfb7515186c71ef3555315eae375e4bf1fdff5267aea751323ae6
RaccoonStealer
dba5e6264deed1c0d630810ce0ba5931e442398ab117ab551f05e77d69613bfb
RaccoonStealer
fc576ede17e81cc2d5229f3a8ff900df35ba9c46fef5c67c8bb0fbb83f418b3e
RaccoonStealer
+ 3'179 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon discovery spyware stealer
Link:
https://tria.ge/reports/210922-w26y8agafr/
Behaviour
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Unpacked files
SH256 hash:
6401fb6f8ebb0d78c61b6801245363759c27cd0441c3936bc84c8f4d97ece762
MD5 hash:
f3b9aeb5c7e9a33791b931d315268277
SHA1 hash:
088543b678a742417a7933b9582991d7740d8b71
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/09dcf793-2bca-47da-af06-259fcc2e33a1/
SH256 hash:
54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2
MD5 hash:
f34cac12ad52c250c2381327d5f5939b
SHA1 hash:
c56cbb5d8ba97932d49146183ecc31045c80b068
Link:
https://www.unpac.me/results/09dcf793-2bca-47da-af06-259fcc2e33a1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190404/

Comments