MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a
SHA3-384 hash: f3cef79870a6b400b0cba4b8fa17b2256fceb4990a9eceb298c5667821e848af0994e93ab82c5f1f2c5f2621d1097288
SHA1 hash: 5c57bf6d8d63c9a322cf63267f860bf8fb2fe08c
MD5 hash: 9d1b1acf7876b24e9defb19e6d261d73
humanhash: happy-skylark-eighteen-fish
File name:9d1b1acf7876b24e9defb19e6d261d73.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:499'712 bytes
First seen:2021-09-10 13:05:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 311b6c030e043059833e0196a691b0ad (3 x RaccoonStealer, 1 x Tofsee, 1 x RedLineStealer)
ssdeep 12288:YaC9uRvoSXDM7IlyYZ4Kmub2epmAWwxa5aQ:YaCsii4rub7pRa5a
Threatray 3'005 similar samples on MalwareBazaar
TLSH T183B4F12077E1E071C466D5B18966C6B09B7E38306974A48FB79D1FAD7F312D2273A382
dhash icon fcfcd4f4d4d4d8c0 (23 x RedLineStealer, 21 x RaccoonStealer, 6 x Smoke Loader)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://5.181.156.77/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.77/ https://threatfox.abuse.ch/ioc/219656/

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9d1b1acf7876b24e9defb19e6d261d73.exe
Verdict:
Malicious activity
Analysis date:
2021-09-10 13:07:18 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/b2ebafb4-b3c9-4088-9f42-115d007116ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186884/
Detection(s):
Win.Packed.Generic-9891933-0
Create hunting rule

Win.Packed.Generic-9891936-0
Create hunting rule

Win.Packed.Raccoon-9892020-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
DNS request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Launching a process
Creating a file in the %AppData% subdirectories
Sending a UDP request
Creating a window
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Enabling autorun by creating a file
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fd932a40-85d4-4f3b-8d16-8304755ccf8c
Result
Threat name:
Clipboard Hijacker Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/848784
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to compare user and computer (likely to detect sandboxes)
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Performs DNS queries to domains with low reputation
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 481215 Sample: vSTM2LDjP1.exe Startdate: 10/09/2021 Architecture: WINDOWS Score: 100 55 Found malware configuration 2->55 57 Antivirus detection for URL or domain 2->57 59 Yara detected Clipboard Hijacker 2->59 61 3 other signatures 2->61 8 vSTM2LDjP1.exe 82 2->8         started        13 sihost.exe 2->13         started        process3 dnsIp4 43 jaliemaval.xyz 94.140.112.64, 49742, 80 TELEMACHBroadbandAccessCarrierServicesSI Latvia 8->43 45 telete.in 195.201.225.248, 443, 49733 HETZNER-ASDE Germany 8->45 47 5.181.156.77, 49734, 49735, 80 MIVOCLOUDMD Moldova Republic of 8->47 33 C:\Users\user\AppData\...\whwgKRLjSU.exe, PE32 8->33 dropped 35 C:\Users\user\AppData\...\vcruntime140.dll, PE32 8->35 dropped 37 C:\Users\user\AppData\...\ucrtbase.dll, PE32 8->37 dropped 39 57 other files (none is malicious) 8->39 dropped 63 Detected unpacking (changes PE section rights) 8->63 65 Tries to steal Mail credentials (via file access) 8->65 67 Performs DNS queries to domains with low reputation 8->67 69 2 other signatures 8->69 15 whwgKRLjSU.exe 1 8->15         started        19 cmd.exe 1 8->19         started        21 schtasks.exe 1 13->21         started        file5 signatures6 process7 file8 41 C:\Users\user\AppData\Roaming\...\sihost.exe, PE32 15->41 dropped 49 Detected unpacking (changes PE section rights) 15->49 51 Uses schtasks.exe or at.exe to add and modify task schedules 15->51 53 Contains functionality to compare user and computer (likely to detect sandboxes) 15->53 23 schtasks.exe 1 15->23         started        25 conhost.exe 19->25         started        27 timeout.exe 1 19->27         started        29 conhost.exe 21->29         started        signatures9 process10 process11 31 conhost.exe 23->31         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-09-10 13:06:10 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxeudoliudna6zj2tyq6ykjz2yk6jhsp7q7wjoyw4aaxbjkfpnna._file
Verdict:
malicious
Similar samples:
03d23ad7ab07c264aa23794c51236157641a98f8a6b40dc063e3403e831b967b
RaccoonStealer
091ee9a9dd7f5501d96e04c9d7cfda6bb6cf3cdcb308f2ef293c123f675d56a7
RaccoonStealer
3fa40031fe4c0dda1a5e228221ab8e839333f6219d74e89114067c332b59bf39
RaccoonStealer
4e9d392e4c1e81ae66624cbc0b45deaf0e5226df7cb34e7e8e0beb245393d891
RaccoonStealer
5a596e7c0f64b2c7f19ff48ef15b1b916845a36100cf76c236a3448a85e3c3dd
RaccoonStealer
675d315e728f48317a23c5f63712f99e82090a2922ecb255f80f2545bfed788a
RaccoonStealer
a457d8e2fd8793653224c3e906c19ca23487de6881d1fd39c4652f336957ab5d
RaccoonStealer
dae96eed94ff74e5ebafaaa9139f0729228775934528e06dba194bace30cf807
RaccoonStealer
dba5e6264deed1c0d630810ce0ba5931e442398ab117ab551f05e77d69613bfb
RaccoonStealer
+ 2'995 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon discovery spyware stealer
Link:
https://tria.ge/reports/210910-qb5etaabc9/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Raccoon
Unpacked files
SH256 hash:
765d19b4728008c1589f222d1fa49f1cb7310204c7a4574eb9f930d0544bed7b
MD5 hash:
043da3110ddd8f5ac84e7f9c0d2d685e
SHA1 hash:
2d13ecbc31ccf9921cbf6f0b2089fae09d4f4395
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/03e0fff4-3ee3-4b15-8179-f6c0cc1921a5/
Parent samples :
b8fa5db247142aeb5f090fe861606d46dbcd50cf36249b0e422384a32d1dfc2b
dd32ec7e9a26563e3088286af32a147b95988188302c65024ed97a5a3b6289c6
7ac7316234cbc2894267e99ceca5574f892cb2e49b66cfb2611d73388f0994b3
24d74834868ad2cd944eb3f5a863383e851bee9231c870258dd5ba4bddf58e83
03d23ad7ab07c264aa23794c51236157641a98f8a6b40dc063e3403e831b967b
dba5e6264deed1c0d630810ce0ba5931e442398ab117ab551f05e77d69613bfb
e4a17e7fabd31dca0c8ffa32fdb6ffbe1d4a696e2a6636186787b8259b95eb54
3fa40031fe4c0dda1a5e228221ab8e839333f6219d74e89114067c332b59bf39
675d315e728f48317a23c5f63712f99e82090a2922ecb255f80f2545bfed788a
75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a
0ddb264e5fcc3d88e1319319d421edb7d12fb66ef73920f8ec45f5e3eddcce07
447ef561d540f7b87bc2c4d822994b35758e8e2fb6e5a37d92b5ed11be769ea6
3c2557c292a2e3a61a85cd44f45f8f3998fd16db3e5e523353eac61a879f726a
561a8533273e9f2b9c5fb33089538d4c70d6b7d6358750ba89dcf3c56417d95d
88bea616209dfb7515186c71ef3555315eae375e4bf1fdff5267aea751323ae6
694c879e26f27610bc40ea419bea615dacb1e3a946a2c843f22af724623d1704
4a6434d66a30ccd95a6c269ba54133d0cade8eb565cd7fd6582abeff8a02a3fc
148c2ff6c877196d1bbdb73f1dc956f5a7dccbab86037648e235c149a3f4eef2
b349af407e596fa823ca28d516ac7ce5481550003d45195e26ea535944cc7f5e
be54f94776405673d2e6d5c453d540dc93c8f4057d4abb0e046b77f926ed9db2
e8d4fc0be0e5dee8f09fe56397cf7c06146ebe9b426d69bef676bfd08431d16a
2f7aa46027a15a329be8297a786d8c9c61f8ae89dcca9a72d88e0cfc08f38ec2
bfb1e4895a98b83a61f405199730fea989dc84ab8acf6e6234e4264db179cc84
fe217c1f1d0ab6e7b287c409a3133a11883ce2832b4f30dce686459751584969
7cfa34e7f6ea3ee53ef9911983581f2c8865363d1e8de9d40ea42775de0f9e7e
51731aae19093da264b42957d2b604f4134a3250aa57a1873c6bfd379c3f4e54
c37ce493533868e32350a7a72a2682092d2e14afaec4c429f6ff1c7d046b3cb4
5f340f1335f9e6a3d4e5c51eb3097e3bdf4d93645b925f537a45477427b87494
e9d0565443dbb2553948e2a89bb580a81470a00ac3108ecb1e67a5a121e9d65c
0ebf095d8bc7029868cd05f7ad20f51c324755881ade188d88ba8ed94d67f788
28a1d5fa2dc4e99192f634223cd08d146980534b6f51b36842a2d7c471868fd8
237c6adb7012050c271ed33932bbd6a18a86dc18ace5841b5c0d52f3fe79dcc1
f6fd32309de31db16489c5aee61ed853407c071488503c27537b82346db81911
SH256 hash:
75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a
MD5 hash:
9d1b1acf7876b24e9defb19e6d261d73
SHA1 hash:
5c57bf6d8d63c9a322cf63267f860bf8fb2fe08c
Link:
https://www.unpac.me/results/03e0fff4-3ee3-4b15-8179-f6c0cc1921a5/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/75c941b968a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 75c941b968a0da0f653a9e21ec2939d615e49e4ffc3f64bb16e00170a5457b5a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1603786/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/186884/

Comments