MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541
SHA3-384 hash: 95d774b5f3f2fb309467602888c225112b0d35b865139dcc58922642e1917f089a70212d300e08e2109deb8495bbe8af
SHA1 hash: 58618b75ea054970b44d357501c50cfe81fcd270
MD5 hash: ebe01963f30d9427bcdb9137983c216b
humanhash: queen-red-bulldog-friend
File name:ebe01963f30d9427bcdb9137983c216b.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'217'024 bytes
First seen:2020-11-01 06:54:11 UTC
Last seen:2020-11-14 21:11:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:G6poW+zuuEk9CVqFkZro6UX6xdXSUWaqjXBPhDyHElrI3Uuc6jI8O:1oW+x9C8FkZ864UWagNhp+jL
Threatray 370 similar samples on MalwareBazaar
TLSH 61452232B1E9AF67D2658FF32075672503F5289B924BF248CAB1A5E08EC6FD04351C97
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
5
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/81585/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.24652.11838.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Azorult ModiLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/517605
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
Creates a thread in another existing process (thread injection)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected ModiLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 307906 Sample: 99GQMirv2r.exe Startdate: 01/11/2020 Architecture: WINDOWS Score: 100 119 agentpapple.ac.ug 2->119 121 taenaia.ac.ug 2->121 143 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->143 145 Found malware configuration 2->145 147 Malicious sample detected (through community Yara rule) 2->147 149 11 other signatures 2->149 11 99GQMirv2r.exe 15 5 2->11         started        16 cmd.exe 2->16         started        18 taskkill.exe 2->18         started        signatures3 process4 dnsIp5 135 morasergiov.ac.ug 217.8.117.77, 49726, 49729, 49731 CREXFEXPEX-RUSSIARU Russian Federation 11->135 107 C:\Users\user\AppData\...\ajhtredfga.exe, PE32 11->107 dropped 109 C:\Users\user\AppData\...\99GQMirv2r.exe.log, ASCII 11->109 dropped 167 Injects a PE file into a foreign processes 11->167 20 ajhtredfga.exe 14 5 11->20         started        23 99GQMirv2r.exe 87 11->23         started        27 a522ayib.exe 16->27         started        29 conhost.exe 16->29         started        31 conhost.exe 18->31         started        file6 signatures7 process8 dnsIp9 87 C:\Users\user\AppData\Local\...\ohtredfga.exe, PE32 20->87 dropped 33 ajhtredfga.exe 20->33         started        38 ohtredfga.exe 3 20->38         started        131 telete.in 195.201.225.248, 443, 49727 HETZNER-ASDE Germany 23->131 133 ourmainpriority.com 104.28.11.180, 443, 49728 CLOUDFLARENETUS United States 23->133 89 C:\Users\user\AppData\...\fEARUQGQTJ.exe, PE32 23->89 dropped 91 C:\Users\user\AppData\...\FgfdL3703K.exe, PE32 23->91 dropped 93 C:\Users\user\AppData\...\410RDx8xB6.exe, PE32 23->93 dropped 95 60 other files (none is malicious) 23->95 dropped 163 Tries to steal Mail credentials (via file access) 23->163 40 FgfdL3703K.exe 23->40         started        42 410RDx8xB6.exe 23->42         started        44 fEARUQGQTJ.exe 23->44         started        48 2 other processes 23->48 165 Detected unpacking (overwrites its own PE header) 27->165 46 powershell.exe 27->46         started        file10 signatures11 process12 dnsIp13 111 jamesrlongacre.ug 33->111 79 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 33->79 dropped 81 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 33->81 dropped 83 C:\Users\user\AppData\Local\Temp\ds1.exe, PE32 33->83 dropped 85 49 other files (none is malicious) 33->85 dropped 151 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 33->151 153 Tries to steal Instant Messenger accounts or passwords 33->153 155 Tries to steal Mail credentials (via file access) 33->155 161 4 other signatures 33->161 50 ds2.exe 33->50         started        53 rc.exe 33->53         started        69 2 other processes 33->69 157 Injects a PE file into a foreign processes 38->157 56 ohtredfga.exe 38->56         started        59 FgfdL3703K.exe 40->59         started        113 cdn.discordapp.com 162.159.134.233, 443, 49737 CLOUDFLARENETUS United States 42->113 115 discord.com 162.159.136.232, 443, 49736 CLOUDFLARENETUS United States 42->115 117 192.168.2.1 unknown unknown 42->117 159 Creates a thread in another existing process (thread injection) 42->159 61 fEARUQGQTJ.exe 44->61         started        63 conhost.exe 46->63         started        65 conhost.exe 48->65         started        67 timeout.exe 48->67         started        file14 signatures15 process16 dnsIp17 137 Injects a PE file into a foreign processes 50->137 123 162.159.135.233 CLOUDFLARENETUS United States 53->123 125 162.159.138.232 CLOUDFLARENETUS United States 53->125 129 2 other IPs or domains 53->129 127 morasergiov.ac.ug 56->127 97 C:\ProgramData\vcruntime140.dll, PE32 56->97 dropped 99 C:\ProgramData\sqlite3.dll, PE32 56->99 dropped 101 C:\ProgramData\softokn3.dll, PE32 56->101 dropped 105 4 other files (none is malicious) 56->105 dropped 139 Tries to harvest and steal browser information (history, passwords, etc) 56->139 141 Tries to steal Crypto Currency Wallets 56->141 71 cmd.exe 56->71         started        103 C:\Windows\Temp\a522ayib.exe, PE32 59->103 dropped 73 cmstp.exe 59->73         started        file18 signatures19 process20 process21 75 conhost.exe 71->75         started        77 taskkill.exe 71->77         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 01:47:04 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lgt35ky4owb3pgk3cv7j5b56w35apboes6cl6c45co6riotjmvaq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
azorult
Create hunting rule
Similar samples:
0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
RaccoonStealer
3e9f05acde528ea5fd7ca9d0c2af0e82d29e343d2f61420290e6f660630cd25f
RaccoonStealer
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
RaccoonStealer
682be0853ccd6f60deb69d27941a628758c4e13e7d2e6ee95a95f415f3a9f0c6
RaccoonStealer
69fe5bb4b975f9437b6c3bcf3f07dc807a8f2e848f1e0c5802012295b06a742c
RaccoonStealer
7e9b9bbb673e25ab8ee790dbfd2a3e489c0d3a88ab73aafe671f68982f1b41da
RaccoonStealer
934609a4e6bbf6eda68c1a09fbd0d5e331229f974148c21aa99add9f94171ec1
RaccoonStealer
9b1328490717e1e3c97216a17bf36b67103a40dae3bbac6865487e51fea82b32
RaccoonStealer
c9c5b4b76ac69632d5f5931198adb5d21d214c72d8524ffc60d7d6bbcd44cf03
RaccoonStealer
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
RaccoonStealer
+ 360 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:modiloader discovery evasion infostealer persistence rat spyware trojan
Link:
https://tria.ge/reports/201101-lrm9s4fv12/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Async RAT payload
ModiLoader First Stage
ModiLoader Second Stage
AsyncRat
Azorult
Contains code to disable Windows Defender
ModiLoader, DBatLoader
Modifies Windows Defender Real-time Protection settings
Malware Config
C2 Extraction:
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
Unpacked files
SH256 hash:
59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541
MD5 hash:
ebe01963f30d9427bcdb9137983c216b
SHA1 hash:
58618b75ea054970b44d357501c50cfe81fcd270
Link:
https://www.unpac.me/results/45bc4f0d-78b2-4bd0-91d6-1f5258987fb1/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/45bc4f0d-78b2-4bd0-91d6-1f5258987fb1/
SH256 hash:
9f8a2bf0ac2fa02ca27b82e4b531b039cdcfed19757c6a970842e38cf3ba1dd5
MD5 hash:
712108dd493ca6f9da02ffd190c33e3e
SHA1 hash:
2bd78f5d7acd0a3ed4e87f41429dd8e58426c56d
Link:
https://www.unpac.me/results/45bc4f0d-78b2-4bd0-91d6-1f5258987fb1/
SH256 hash:
f9f54d6bd22b9ccecb3329ebf528e7211e339210ef571c7c94149ed8de6801c2
MD5 hash:
b45597d7b319d94b5eebb23ee78c787a
SHA1 hash:
7a0485014dd97c38c136c5319a72a15b02ba82d7
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/45bc4f0d-78b2-4bd0-91d6-1f5258987fb1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/446435/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/446430/
  
URLhaus
https://urlhaus.abuse.ch/url/584223/
  
URLhaus
https://urlhaus.abuse.ch/url/677625/
  
URLhaus
https://urlhaus.abuse.ch/url/677631/
  
URLhaus
https://urlhaus.abuse.ch/url/399076/
  
URLhaus
https://urlhaus.abuse.ch/url/422736/
Cape
Cape
https://www.capesandbox.com/analysis/81585/

Comments