MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d
SHA3-384 hash: df879cb05f2535fc14d9772e379f18ec071149d8a2eea1d445d08a3b1898084098424dfcb1ffd40e67fc1aa7691a9812
SHA1 hash: b1afa813527d6ac434e0f59c2800f905f4661dd9
MD5 hash: 498464e09964f85678853264f5c265b5
humanhash: sweet-tennessee-grey-texas
File name:498464e09964f85678853264f5c265b5.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:591'872 bytes
First seen:2021-03-13 07:30:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 79a39819aff4ad4e946c152b87e0d79a (2 x RaccoonStealer)
ssdeep 12288:9WlT6YAkLfasIahyYWEAneaw/fS2W7GkqJLri4t37hA:9eYkLfMRGAneaw/6ERhXg
Threatray 434 similar samples on MalwareBazaar
TLSH 60C4CF1066A1D034F4BB63F8CD7992656B39B9B1AB3495CF72E52AEA16342F0DC70313
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
498464e09964f85678853264f5c265b5.exe
Verdict:
Malicious activity
Analysis date:
2021-03-13 07:31:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cfcdd5a0-c73e-4fca-a488-4a6c3108b07a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/124045/
Detection(s):
Win.Packed.Tofsee-9840603-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/638460
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 13:20:54 UTC
AV detection:
28 of 47 (59.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkc47v574cun73uixj7vjnsyyl43m57gduaqhfrvlrppk6a6ar6q._file
Verdict:
malicious
Similar samples:
194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2
RaccoonStealer
6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
RaccoonStealer
706a3b4438e7b883d8c3cd66ffabfbb3e3495b3b7c6f9b48adf7a5c8cdd0c3c1
RaccoonStealer
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
RaccoonStealer
a6e43031567484437341b50ea0c165ad416ffa629e2951a0e82844dcfb27e408
RaccoonStealer
bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac
RaccoonStealer
c394b83a255961adb3ec0c8e35b21e05ee432b3c758b25ceac7e3dc3a10486a7
RaccoonStealer
c84d7d17bace5f7ab474440491d7c3aa0be6fabbd5fab86106b10a45e4b97bfc
RaccoonStealer
d7420d82ddf1f14456c5c8fc3c1a4a128937bad4d34794dbe103aacc4a2aa699
RaccoonStealer
e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5
RaccoonStealer
+ 424 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:ddcbd6366de67d1cf1d10203593a074aab7abd55 stealer
Link:
https://tria.ge/reports/210313-9rtctnetw6/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
1aa47cb22e407892616618fe2adc633a245d5dc022bf0f105cc0b7a67a9d6f6a
MD5 hash:
72f6d2ff36798c266ddb0b3755dec951
SHA1 hash:
ce30345693180d024b301dfd0f527343453f30a1
Link:
https://www.unpac.me/results/c7bb8552-6225-44ed-bfb1-34d2af2742b3/
Parent samples :
1780d38ef73129177134042720cfc526fe012760f406e9e030d8d5fbbdfb7828
a2a7e43ce1a853842ecb2bdb665b180119d539d56ce2c2eab1a54d098cc92edd
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
c84d7d17bace5f7ab474440491d7c3aa0be6fabbd5fab86106b10a45e4b97bfc
194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2
a3280da75d606d54a450b69372eca59b6f5f3a934e461c68b4d2e38f6223046e
66496b0a09ac29095bc092f123a6ce7362ba199fccc1906f27c956312eca9c8c
106c0169d2464a9efe9ee45c1e7c5863764e6d9fca3809bb249bbb97d3cf3086
c394b83a255961adb3ec0c8e35b21e05ee432b3c758b25ceac7e3dc3a10486a7
bcc49344ddab6a3271480eafb423ee292ed4b2d32792f1b79ed72db0ad856665
bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac
c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e
d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd
SH256 hash:
6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d
MD5 hash:
498464e09964f85678853264f5c265b5
SHA1 hash:
b1afa813527d6ac434e0f59c2800f905f4661dd9
Link:
https://www.unpac.me/results/c7bb8552-6225-44ed-bfb1-34d2af2742b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 6285cfd7bfe0a8dfee88ba7f54b658c2f9b677e61d010396355c5ef5781e047d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1054507/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124045/

Comments