MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0
SHA3-384 hash: 4867b9113875345a136836096ff0ff9e059f40f226500a66c682ae3a83460841aed50a81125992a39e31d49fca70da43
SHA1 hash: 95c128fb77411b7b8ee1c5164342b7069fea70c1
MD5 hash: d2fa93d20238edc7d7678cc29709b6f5
humanhash: massachusetts-monkey-blue-coffee
File name:d2fa93d20238edc7d7678cc29709b6f5.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:555'520 bytes
First seen:2021-11-23 08:41:01 UTC
Last seen:2021-11-23 11:06:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b90a6995421b6eb79d6bcd36b44f24cf (11 x RedLineStealer, 4 x ArkeiStealer, 1 x Tofsee)
ssdeep 12288:pq8M1fphFZNJ6Q5F5nMs1wipgZKF7DyTp7FZ/m:pq8UfPFR6Q5F5nJ1hpgZKi7q
Threatray 4'332 similar samples on MalwareBazaar
TLSH T1AEC4F10067B0C035F1B712F49DBAD3646A3E7DA16B3995CF52D426EA6674AE0EC3031B
File icon (PE):PE icon
dhash icon 60f8e8e8aa62a489 (1 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d2fa93d20238edc7d7678cc29709b6f5.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-23 10:00:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/810e57cf-3d61-4ff8-a7da-e86c1e2e2466

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Jaik.49513.19807.14334.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/619ca928f36138de3f36afc5/reports/54e1c911-e4a2-48c3-b11c-cf8a01e6543f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2c26d836-986f-4b7f-b209-0fff06e2ae9c
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/894506
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-11-23 08:41:14 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
32 of 45 (71.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=latntvvuksxltvgnhkj7zsbbgqgw25xizhctpxjtftl74erlzdqa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318
RaccoonStealer
6de652315ec81355613e5aa698e993cc44e46db0f40ee26e6613aa79aea5cdfd
RaccoonStealer
976b30ed3b9f1a8f02bac54aac1876534fd55ee277ca288c972774f20051f055
RaccoonStealer
aaecc6d2397e862afe8e60769d28847e1a634954d2c003f5a9975262d66ba47f
RaccoonStealer
dd342468231a6e7e5cd08f7003da4185736c258be4cd0ecd61ff119d664c6b9b
RaccoonStealer
ff0b4793d0a5080966f28c746fb402ad56931a967dce572d3c2f8ddbd4b7acb8
RaccoonStealer
+ 4'322 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:b78eb5a9f2070a9354e23b67827ba02d1d9e0f17 stealer
Link:
https://tria.ge/reports/211123-klghvahfal/
Behaviour
Raccoon
Unpacked files
SH256 hash:
1564c3c132b4a846d89a32a1ac16460cb4e2751e5322e5a9e91b131418811277
MD5 hash:
726fff836dbd57136957155bc969937d
SHA1 hash:
dfa2ca09f3d1f2504a6cd983ae3fc3ba81dc32be
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/779d3b8e-3e5d-4c55-b0fd-402fc57a3d40/
Parent samples :
d2667d8a4062bd3dbb04570411a184b6d4a72584f1cd11fb74a145a62c2084b6
37393e775419461d8973fc596cd174cc6ff417e07d19d95aacb02cad3f4367b1
58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318
42f71f7375ace133817bcdf3ed89a994cba9772fc7d9cb084cd78f4afb379026
e4cd6a7b62c12b5afbe9d31ffd4d538d1248e0231cd4af7e1217ce0d7b5bbec3
5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0
d3e12edcfc74eb3d0c54fb626db2d61a82553186504d6fe249bbba792935d425
SH256 hash:
5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0
MD5 hash:
d2fa93d20238edc7d7678cc29709b6f5
SHA1 hash:
95c128fb77411b7b8ee1c5164342b7069fea70c1
Link:
https://www.unpac.me/results/779d3b8e-3e5d-4c55-b0fd-402fc57a3d40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208592/

Comments