MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 5 File information Comments

SHA256 hash:	6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
SHA3-384 hash:	0c770575cb288794fdde4c471a01b60fd0829b6bdc010f21564242ce1943d93cae882c80ccfbe56cd92abca22aa10c4c
SHA1 hash:	55bc37a5e07e98e6eb3cf6dddb92af9bfcd468c1
MD5 hash:	8cbb8a992809bde1ac42a4b48345d63d
humanhash:	ten-pasta-robert-xray
File name:	8cbb8a992809bde1ac42a4b48345d63d.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	442'368 bytes
First seen:	2021-03-11 07:29:33 UTC
Last seen:	2021-03-11 09:47:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ae8fa41b67cfaa23aae684387501c7f0 (3 x RaccoonStealer)
ssdeep	6144:M2FaL/DEN4RBbqN/dyxvsckweRMEaUll22y1Q1+gMLPLVwqo47aBlysDhQR3+x:LFa8oBImvtkjMEfjtSE+pLD7Alysfx
Threatray	573 similar samples on MalwareBazaar
TLSH	D894F11029B1D036D7855AF40879C6B51A3BBCA55F235AC3779C7A3AAF322D18F39342
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8cbb8a992809bde1ac42a4b48345d63d.exe

Verdict:

Malicious activity

Analysis date:

2021-03-11 07:30:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5098a87f-3eb8-412d-8cfb-d7c72107d078

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/123720/

Detection(s):

SecuriteInfo.com.Trojan.Siggen12.34181.16041.20497.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Sending a TCP request to an infection source

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/636519

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2021-03-10 23:33:42 UTC

AV detection:

21 of 47 (44.68%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=n76mcwylhcjxhanb6q5ta44qshyhvdtpxoqf5fgf3fz4dig3yxvq._file

Verdict:

malicious

RaccoonStealer

18f6edcc25f8528d841203138beedaee611f3b3d17fbc5e13be8fd744ca413ed

RaccoonStealer

194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2

RaccoonStealer

3b219425cdb19d82ebaae01c07270435f8bec250679f9b4f18b0ff47a6e9ca37

RaccoonStealer

71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6

RaccoonStealer

78f5967d8bd5d31343632e8558b9315d9d44d009c923b9c41d417943906f2849

RaccoonStealer

854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422

RaccoonStealer

a6e43031567484437341b50ea0c165ad416ffa629e2951a0e82844dcfb27e408

RaccoonStealer

cc77c899048dadecb42238532dff0969e362bfe01cf5507f1462d71ce58360ba

RaccoonStealer

e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5

RaccoonStealer

+ 563 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:afefd33a49c7cbd55d417545269920f24c85aa37 discovery spyware stealer

Link:

https://tria.ge/reports/210311-e6rhs5vzq6/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Raccoon

Unpacked files

SH256 hash:

0a00415f8e43a51ceccaa6599bdb216148fe0cbc895b2acfa137e819cda36681

MD5 hash:

48ff9d7470c13b9de99968bd76f5db1e

SHA1 hash:

5cbe772066d7c7f0b512f58267c1250907b0849e

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/3fdb3bfb-00d5-42d4-b0bb-945ffca56685/

Parent samples :

6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085
9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55
8fd17cdc025ce08669dae201714f915a869554bd8339fe494dc58b29ec4c8110
2d07abc10994157494bad3b2a9d5181c040fd8e230a168d5b9d9aaf19390ab5d
b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d
9f9db94621c74bf0f8e8d8a4fc2b1319e11f3d87cb90ba8b20c2945a53a6b874

SH256 hash:

6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb

MD5 hash:

8cbb8a992809bde1ac42a4b48345d63d

SHA1 hash:

55bc37a5e07e98e6eb3cf6dddb92af9bfcd468c1

Link:

https://www.unpac.me/results/3fdb3bfb-00d5-42d4-b0bb-945ffca56685/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator