MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318
SHA3-384 hash: 9648223c5a92bf101529341380a26422136ca25a58f834088ddb8e37371700ccbe9d381d9e3032150b4780cce20b7aa4
SHA1 hash: 9e871a0a51d1e05715ff716d574d5ab438e8f291
MD5 hash: bd9fe45aacd5ed479f774df7eabe9f5b
humanhash: item-tennessee-alaska-beer
File name:bd9fe45aacd5ed479f774df7eabe9f5b.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:602'624 bytes
First seen:2021-11-16 21:13:30 UTC
Last seen:2021-11-16 23:02:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 807d42501d7f7832d883135d05fffe34 (2 x RedLineStealer, 2 x RaccoonStealer, 2 x Smoke Loader)
ssdeep 12288:S5G3VLR2FMe6fJKlBhgz+KC9MxxkHtLO3HPG:S0FLZejlrBx9M7kHtK3vG
TLSH T1E3D4D010B6A0C035F1F712F899BAA269B93F7A91673594CF12C416EE4B34AE5EC31317
File icon (PE):PE icon
dhash icon b6dacabecee6baa2 (18 x RedLineStealer, 12 x Stop, 9 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206661/
Detection(s):
SecuriteInfo.com.Variant.Ulise.226428.29060.17030.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request
DNS request
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61941f2143e8f62b6695e6e9/reports/9344f827-312a-489f-9efb-4ff984b581ae/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5eb6fb83-623f-4b13-a23a-3aad14d62f3b
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/890759
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-16 21:14:10 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ldsvvtq6kdk5uvaflqfnkwpixceckwsyny3dxtyixnzi7ejh6mma._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:b78eb5a9f2070a9354e23b67827ba02d1d9e0f17 stealer
Link:
https://tria.ge/reports/211116-z3ccsafed8/
Behaviour
Raccoon
Unpacked files
SH256 hash:
1564c3c132b4a846d89a32a1ac16460cb4e2751e5322e5a9e91b131418811277
MD5 hash:
726fff836dbd57136957155bc969937d
SHA1 hash:
dfa2ca09f3d1f2504a6cd983ae3fc3ba81dc32be
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/91a0a157-18b9-442e-9805-99662771f05b/
Parent samples :
d2667d8a4062bd3dbb04570411a184b6d4a72584f1cd11fb74a145a62c2084b6
37393e775419461d8973fc596cd174cc6ff417e07d19d95aacb02cad3f4367b1
58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318
42f71f7375ace133817bcdf3ed89a994cba9772fc7d9cb084cd78f4afb379026
e4cd6a7b62c12b5afbe9d31ffd4d538d1248e0231cd4af7e1217ce0d7b5bbec3
5826d9d6b454aeb9d4cd3a93fcc821340d6d76e8c9c537dd332cd7fe122bc8e0
d3e12edcfc74eb3d0c54fb626db2d61a82553186504d6fe249bbba792935d425
SH256 hash:
58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318
MD5 hash:
bd9fe45aacd5ed479f774df7eabe9f5b
SHA1 hash:
9e871a0a51d1e05715ff716d574d5ab438e8f291
Link:
https://www.unpac.me/results/91a0a157-18b9-442e-9805-99662771f05b/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/58e55ace1e50/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 58e55ace1e50d5da54055c0ad559e8b888255a586e363bcf08bb728f9127f318

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206661/

Comments