MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5692034f83380042a7ff741622d94271dc540d2d4b0a46f5aafc05498225f5a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments 1

SHA256 hash:	5692034f83380042a7ff741622d94271dc540d2d4b0a46f5aafc05498225f5a6
SHA3-384 hash:	bf8219544ddefb8b6bfa47b8b9055c5fd5cfff0828a8fcd8eb222cd7372f89a012b26e5fd4b2f4f6ed1324c97a101989
SHA1 hash:	c394dc81061578fb70af0747f5284dbf5dec4700
MD5 hash:	6a46023492d437f7a9ef76a8a9b38684
humanhash:	kilo-west-harry-video
File name:	6a46023492d437f7a9ef76a8a9b38684
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	1'073'664 bytes
First seen:	2021-09-26 13:44:38 UTC
Last seen:	2021-09-26 16:30:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	852551719e3ff5d6f84ac5d0cab1e5e4 (1 x RaccoonStealer)
ssdeep	12288:Vv0OyFHg9rfrZ89rOYrOOo119uYd4J9A3i/OVFrPf2VQpz6TWXPL4ZavQAOy9A+9:hXyFHKrfl89qXC4YODrXzzCWXz4Y5A+
Threatray	3'274 similar samples on MalwareBazaar
TLSH	T1C8356CBCAA0E9826F5AC2BB042C31F543D2A7994B268610FF26A7F483D577D4BD05F44
Reporter	zbetcheckin
Tags:	32 exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6a46023492d437f7a9ef76a8a9b38684

Verdict:

No threats detected

Analysis date:

2021-09-26 13:45:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fc5ab524-d3bb-4168-a855-1b2c49ee075a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/191763/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.47019901.12369.20451.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cf03ad5f-5f7e-48d8-b405-75d31567b930

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/858407

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file has nameless sections

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5692034f83380042a7ff741622d94271dc540d2d4b0a46f5aafc05498225f5a6/

Threat name:

Win32.Ransomware.WannaCry

Status:

Malicious

First seen:

2021-09-22 23:49:31 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2jagt4dhaaefj77oqlcfwkcohofidjnjmfen5nk7qcutarf6wta._file

Verdict:

malicious

Label(s):

raccoon

RaccoonStealer

44bc3362221be1888156d1a7d5c29490a2c449d6cabe6766ecb6878500562057

RaccoonStealer

487f7c670fd41c29794ecf4577efba0790553a1b4895f85a54ac42d2e1f546bd

RaccoonStealer

726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768

RaccoonStealer

78d2e3ffb53da033d7df217d5a67ea52dbac7928cb77d907307a1c77b4453cfe

RaccoonStealer

79353b4beb5c15fb26a1a4e35742da675a5adeff230f9a4d8f3577d47e263e97

RaccoonStealer

7dab69ecef0dc000e97634c8bf2840242b9e75038f32c0eac5eb79772309e43c

RaccoonStealer

8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6

RaccoonStealer

bc138287ed714ea942a062c9efc9775f6eaaefdb778b6d091d2dff02b284b8ed

RaccoonStealer

c660d57bd98c4b7cecedeaa8405adba7ba4057e6f1ce62636a5d1003fea36e61

RaccoonStealer

+ 3'264 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:c244fe57ee1163af02d94497aac3470401ca7c4d stealer

Link:

https://tria.ge/reports/210926-q2dpsaehe7/

Behaviour

Raccoon

Unpacked files

SH256 hash:

da52469bdec75914087954c5da1fbc864e4239af9cfc16a8b93ee4a87da49fea

MD5 hash:

0057b6b6f63617c4b00b252761cc0766

SHA1 hash:

dd315620345c58de129d8575271ff7a7f3cfddce

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/d0916443-41ea-4ec7-9e85-09e7e55a6b96/

SH256 hash:

5692034f83380042a7ff741622d94271dc540d2d4b0a46f5aafc05498225f5a6

MD5 hash:

6a46023492d437f7a9ef76a8a9b38684

SHA1 hash:

c394dc81061578fb70af0747f5284dbf5dec4700

Link:

https://www.unpac.me/results/d0916443-41ea-4ec7-9e85-09e7e55a6b96/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/5692034f83380042a7ff741622d94271dc540d2d4b0a46f5aafc05498225f5a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers