MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71cffe242e5525e46eb17084c15b57d111b3aff005f37ee330ad21ae8b239d48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71cffe242e5525e46eb17084c15b57d111b3aff005f37ee330ad21ae8b239d48
SHA3-384 hash: 47860b0b81bac2312e32bc0699e22a7d423ca45621f994e972f233ebe2c3ef82c829f89bc4ebe26339c9c17eeaa6af73
SHA1 hash: d5f1babe7e2e0972f3043a793c8c1267a3578639
MD5 hash: 6c96e1d8495090e4c8953f49cc021d45
humanhash: thirteen-earth-music-kansas
File name:6c96e1d8495090e4c8953f49cc021d45.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'055'232 bytes
First seen:2022-02-17 19:51:38 UTC
Last seen:2022-02-17 21:47:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 24576:H4u4OBPojeDfnLG0H+AIIKkEaHNYK35blbgDow:HrBgjeDLG0HhI7Na3ZEkw
TLSH T11C2501DC848ADF6ACDC46BBDA3ACD4D96F384EC1EAD95D92586EC8525C213201073EF4
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://194.180.191.124/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.180.191.124/ https://threatfox.abuse.ch/ioc/388507/

Intelligence

File Origin
# of uploads :
2
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242389/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/620ea768875593a3ccdfefe2/reports/f19cab24-d3e5-4b08-a4a8-9490b36c41b4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e48c092a-abb4-4921-91a9-b0e2315dd10f
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/941895
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 574373 Sample: cXM38CTnaL.exe Startdate: 17/02/2022 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 4 other signatures 2->44 8 cXM38CTnaL.exe 1 2->8         started        process3 signatures4 46 Writes to foreign memory regions 8->46 48 Allocates memory in foreign processes 8->48 50 Injects a PE file into a foreign processes 8->50 11 AppLaunch.exe 80 8->11         started        16 conhost.exe 8->16         started        process5 dnsIp6 32 185.163.45.39, 80 MIVOCLOUDMD Moldova Republic of 11->32 34 194.180.191.124, 49762, 80 MIVOCLOUDMD unknown 11->34 36 2 other IPs or domains 11->36 24 C:\Users\user\AppData\LocalLow\...\nss3.dll, PE32 11->24 dropped 26 C:\Users\user\AppData\...\mozglue.dll, PE32 11->26 dropped 28 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 11->28 dropped 30 56 other files (none is malicious) 11->30 dropped 52 Tries to steal Mail credentials (via file / registry access) 11->52 54 Tries to harvest and steal browser information (history, passwords, etc) 11->54 56 DLL side loading technique detected 11->56 18 cmd.exe 1 11->18         started        file7 signatures8 process9 process10 20 conhost.exe 18->20         started        22 timeout.exe 1 18->22         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71cffe242e5525e46eb17084c15b57d111b3aff005f37ee330ad21ae8b239d48/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2022-02-17 19:52:12 UTC
File Type:
PE (Exe)
AV detection:
16 of 43 (37.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohh74jbokus6i3vroccmcw2x2ei3hl7qaxzx5yzqvuq25czdtvea._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220217-yldzlsdgg7/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
ff829bf9cc88d247329350ec45ca561c6ebc84095a1810ab238eeff7812f53d8
MD5 hash:
47b3bb93a8a5fb5c83f4f15dd4661bd4
SHA1 hash:
f9dd9fa3ebae391f6ab2591d61bf7875e66cffa9
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/16533f3d-5b67-433f-a876-bd72da9a6742/
SH256 hash:
7bc0c14d73accc44f83dfb1a7509f59d8e4fc250160c11674a8e3e979175fc8d
MD5 hash:
b1c6c55566d63b66be6e704a40a5fdfa
SHA1 hash:
1451187a7ea3c513b315211659323a247f0c2652
Link:
https://www.unpac.me/results/16533f3d-5b67-433f-a876-bd72da9a6742/
SH256 hash:
71cffe242e5525e46eb17084c15b57d111b3aff005f37ee330ad21ae8b239d48
MD5 hash:
6c96e1d8495090e4c8953f49cc021d45
SHA1 hash:
d5f1babe7e2e0972f3043a793c8c1267a3578639
Link:
https://www.unpac.me/results/16533f3d-5b67-433f-a876-bd72da9a6742/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/71cffe242e5525e46eb17084c15b57d111b3aff005f37ee330ad21ae8b239d48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/242389/

Comments