MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 12
| SHA256 hash: | 7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c |
|---|---|
| SHA3-384 hash: | d6fb7573b0cd3f5642c2a869b5d1c70438493c51649343960c427e03815eebfb189ecc94fd1b0f392ecf917184b9d188 |
| SHA1 hash: | ba795084b2b4b46b9f66fddc1fd908cc87fd852b |
| MD5 hash: | 23fed1c9856f4e0565d76ba346197dbc |
| humanhash: | quiet-william-cup-louisiana |
| File name: | 7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 555'008 bytes |
| First seen: | 2021-05-08 21:25:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 48e796cf546b09988f5fd57d931d6e76 (1 x RaccoonStealer) |
| ssdeep | 12288:LzvE1UPQNHSqUORyI2hY7GSAmkdckNBpuIn2S:LbFINHSORpaYiIackNB4g2S |
| Threatray | 594 similar samples on MalwareBazaar |
| TLSH | 4FC4CF10EFB1D034F5B26AF44A7992D8693A7E726B3488CF12C212DA5A346F49C71377 |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://34.89.59.109/ | https://threatfox.abuse.ch/ioc/33419/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Detection:
raccoon
Threat name:
Win32.Trojan.Azorult
Status:
Malicious
First seen:
2021-02-22 21:04:13 UTC
AV detection:
38 of 47 (80.85%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 584 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:a3a85b69314053c3bb015532d1a960a3d08baeb8 stealer
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
67f351a64c9620363026657b7d526a1d8ba9f3de994b5c41bb3302c267045bbb
MD5 hash:
db0cb8be1680a2386fa3619afceb6a0c
SHA1 hash:
5a419a2a3e3522a2e498043bf0aae5acc6367859
Detections:
win_raccoon_auto
Parent samples :
84c9d8e33e9bbff6837052a08a5d6f61d3a5815898a24b0739413ed1feb56976
48543c618981b229afd8f50a0cc5581e4325d098b1fc95c3074609d31e5e86a3
063d7b432fa85262f3515bbd8b51f81f3461a2e413b5782471ee5ab08fca59c0
41777ed7d655a1cb0fe45a38f46964172a7328b5620ecc4bfb83964988505b27
92382497db841b91fc6b839b02f987ecf14b5b05c640a96c14101bd3aff9c53b
b73f93e91a15df59bb37943b13e4edb6ac60a97915b40cc7bbc236a8ff414233
6232b30079357a00484db96ecfdb071ab91abcb68e1f79a5fb066686c2d47db4
7e1ec9f49ccabe604a9e5ee1a0d0eb4d6e2ae186be3ce20dfbfc6901ddef91b8
3fd9bf266e8f691a595afa62dd3570a091bb4e0909c0a2bb1eff134a61e67a3f
a91f9ed279df4ccb513683888426fe3635c3d20fca30692734b3958787079390
7fadf8cac7e4de6c1e6d1c628eb9a7723e264d1b0bec899a7dd41afe671fa72f
802c13d50de80d1771e4e11ad6dbacab634728457aa33c9caf3d80392d1e1037
8cf23761c7e513c8c553ebb001b91aec6e67feaac6568046e19dd7d4eed7c8e0
b72527908beb5d234fd8e8d2eb3894c093e23ac79399fef8ac409adf973f1f84
eb9eabe4e55d85004b03c404a09eca6855ddd071287e28e6bbe22cb08802945a
e3a557d419c175be7db2ea441c0c97a5156fece6710f51466c5b623d4fae0bb8
a07bff50fc241defe458c76a1a47eba870d30bdcd1d2a1594de71f46a32b2f28
094def68b3d08f93556bc544358eec1e6e63ae768fbff967a2f404cfe944e05b
cbe01313f457dfc188193a50d3e4c13d159b28cecc7f88b195dac6dafa04f0ad
5ab8788113048f70c035d2f84de34cc2a5cb08533474b917e47893bea3daac2a
7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c
8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07
48543c618981b229afd8f50a0cc5581e4325d098b1fc95c3074609d31e5e86a3
063d7b432fa85262f3515bbd8b51f81f3461a2e413b5782471ee5ab08fca59c0
41777ed7d655a1cb0fe45a38f46964172a7328b5620ecc4bfb83964988505b27
92382497db841b91fc6b839b02f987ecf14b5b05c640a96c14101bd3aff9c53b
b73f93e91a15df59bb37943b13e4edb6ac60a97915b40cc7bbc236a8ff414233
6232b30079357a00484db96ecfdb071ab91abcb68e1f79a5fb066686c2d47db4
7e1ec9f49ccabe604a9e5ee1a0d0eb4d6e2ae186be3ce20dfbfc6901ddef91b8
3fd9bf266e8f691a595afa62dd3570a091bb4e0909c0a2bb1eff134a61e67a3f
a91f9ed279df4ccb513683888426fe3635c3d20fca30692734b3958787079390
7fadf8cac7e4de6c1e6d1c628eb9a7723e264d1b0bec899a7dd41afe671fa72f
802c13d50de80d1771e4e11ad6dbacab634728457aa33c9caf3d80392d1e1037
8cf23761c7e513c8c553ebb001b91aec6e67feaac6568046e19dd7d4eed7c8e0
b72527908beb5d234fd8e8d2eb3894c093e23ac79399fef8ac409adf973f1f84
eb9eabe4e55d85004b03c404a09eca6855ddd071287e28e6bbe22cb08802945a
e3a557d419c175be7db2ea441c0c97a5156fece6710f51466c5b623d4fae0bb8
a07bff50fc241defe458c76a1a47eba870d30bdcd1d2a1594de71f46a32b2f28
094def68b3d08f93556bc544358eec1e6e63ae768fbff967a2f404cfe944e05b
cbe01313f457dfc188193a50d3e4c13d159b28cecc7f88b195dac6dafa04f0ad
5ab8788113048f70c035d2f84de34cc2a5cb08533474b917e47893bea3daac2a
7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c
8fcc19c0ead093cdeedea2c1ecee99328c672779eae9a9a1507f8e422d56dd07
SH256 hash:
7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c
MD5 hash:
23fed1c9856f4e0565d76ba346197dbc
SHA1 hash:
ba795084b2b4b46b9f66fddc1fd908cc87fd852b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [B0012.001] Anti-Static Analysis::Argument Obfuscation
2) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
3) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
4) [C0046] File System Micro-objective::Create Directory
5) [C0049] File System Micro-objective::Get File Attributes
6) [C0052] File System Micro-objective::Writes File
7) [C0033] Operating System Micro-objective::Console
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0041] Process Micro-objective::Set Thread Local Storage Value
10) [C0018] Process Micro-objective::Terminate Process