MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74c34820bf33a276614e9802dc16922a6c25e33a250931ea388e8b1480b6580f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74c34820bf33a276614e9802dc16922a6c25e33a250931ea388e8b1480b6580f
SHA3-384 hash: d369363116c7fbec5d0d39e56ee96d404c33d6851f42522ba86eb764774ae451ee7887c3f7a83b1623a893bbc057cdfb
SHA1 hash: 94dda24ae4954691687ecf1cbde9d0b38dbe0bb3
MD5 hash: fdb68f536679ec4995bcf92e0506c67a
humanhash: may-sink-island-fix
File name:FDB68F536679EC4995BCF92E0506C67A.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:500'736 bytes
First seen:2021-09-23 11:16:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a5f1519af792c7c894446b2b7f883ca8 (2 x Stop, 1 x CryptBot, 1 x Smoke Loader)
ssdeep 6144:va3pFh03jMI6UTVAsEhLojUwEeyaWOIZfLrdoCK8ajWTmqkgx+8Npz43Ez/J5grS:g303jMIrVvEhLmUdnfOauCth5gWfkt
Threatray 3'435 similar samples on MalwareBazaar
TLSH T1ECB4E020AB90C036F9FB11F469B697B8352E7A716B2450CFA2D567EA02346F5EC30753
dhash icon e0e6e2eceedafc6c (1 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.163.204.36/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.204.36/ https://threatfox.abuse.ch/ioc/225650/

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FDB68F536679EC4995BCF92E0506C67A.exe
Verdict:
Malicious activity
Analysis date:
2021-09-23 11:17:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/86b9cf2a-371a-4722-839e-22e3bfcfc48b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/190732/
Detection(s):
Win.Packed.Generic-9890178-0
Create hunting rule

Win.Malware.Generic-9890222-0
Create hunting rule

Win.Dropper.Raccoon-9890239-0
Create hunting rule

Win.Packed.Generic-9890255-0
Create hunting rule

Win.Malware.Generic-9890308-0
Create hunting rule

Win.Dropper.StopCrypt-9890322-0
Create hunting rule

Win.Packed.Jaik-9890329-0
Create hunting rule

Win.Packed.Jaik-9891196-0
Create hunting rule

Win.Packed.Jaik-9891200-0
Create hunting rule

Win.Dropper.Raccoon-9892961-1
Create hunting rule

Win.Dropper.Generickdz-9893534-0
Create hunting rule

Win.Packed.Generic-9893540-0
Create hunting rule

Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c66d86f4-a9c0-49d0-a9c7-9bbf40caa2f1
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/856787
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/74c34820bf33a276614e9802dc16922a6c25e33a250931ea388e8b1480b6580f/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-09-02 12:39:06 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=otbuqif7gorhmykotabnyfusfjwclyz2euetd2ryr2frjafwlahq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
2db5b8398fe40439d40336311f84437499781d8659a4557b76ff7db71fa4e05e
RaccoonStealer
2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324
RaccoonStealer
7578b1f217fca3612bbabadca671494f35cbada8d58fc11c68092477c99ec084
RaccoonStealer
9abec502e3a5167e3851de29c80c681de2c6ab879a0c49646f92761018c7987b
RaccoonStealer
ca9d13706dad307a2021d1fa1683e46b5b9670b92ad0ee5e474cbea0620d6299
RaccoonStealer
d5b3a05a83dac1fde11c26bb358f513ddf0cb57853a141fecccda0446c842f81
RaccoonStealer
e62b16ade666583889fd05c9046a0d724c9e429cb8e92cc6fb1ec371e8b918e1
RaccoonStealer
e671deac46898cd1ce138deb64f63c2a7d09f40b593213e2337b0ffa08aab8e7
RaccoonStealer
+ 3'425 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:7b50562d46a6ff381454b5bc7d0142f613a967c2 stealer
Link:
https://tria.ge/reports/210923-ndpe9shehq/
Behaviour
Raccoon
Unpacked files
SH256 hash:
3c6fb9c4407ecba173b6eb75e003b02b0f26e1816d8bb6a7c451aa804999143e
MD5 hash:
8f0e2fe5fd5ae9c03e5b5aad0d3a7887
SHA1 hash:
bb232d204bd9092c145f12335a3f9b2c68878cae
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/f98ce223-f102-4897-851d-12bb02a8b38d/
SH256 hash:
74c34820bf33a276614e9802dc16922a6c25e33a250931ea388e8b1480b6580f
MD5 hash:
fdb68f536679ec4995bcf92e0506c67a
SHA1 hash:
94dda24ae4954691687ecf1cbde9d0b38dbe0bb3
Link:
https://www.unpac.me/results/f98ce223-f102-4897-851d-12bb02a8b38d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74c34820bf33a276614e9802dc16922a6c25e33a250931ea388e8b1480b6580f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190732/

Comments