MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4
SHA3-384 hash: a02cd90c63a3f1e18a97fa2773781ade40e18f10779723ea7fedd3553eb57cb4043a35b3ff15a483f7bd56c7002b3539
SHA1 hash: 2454224b70016a92924d0310c1f3c189eb925001
MD5 hash: d42ac5ff77d588426a1affbccecb472d
humanhash: oscar-princess-muppet-may
File name:d42ac5ff77d588426a1affbccecb472d.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:504'320 bytes
First seen:2021-07-23 13:51:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c53e08bb6beec713632928ff71fb4e4b (7 x RedLineStealer, 6 x RaccoonStealer)
ssdeep 12288:NorMABo++XMPt6dDGrDSXT+ojGaTIlOyHCL:NTvcPsd+gT+oGwyiL
Threatray 1'679 similar samples on MalwareBazaar
TLSH T1B4B40210F601C8B2C52555772CE7C6A469AEBC3659B884037BD56EEF1F302C2A66E31B
dhash icon 48b9b2b0e8c18c90 (18 x RaccoonStealer, 5 x Smoke Loader, 3 x Glupteba)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.234.247.50/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.234.247.50/ https://threatfox.abuse.ch/ioc/162348/

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d42ac5ff77d588426a1affbccecb472d.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 13:53:30 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/b28e32c3-7571-4652-aefe-7927f0c72f00

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173652/
Detection(s):
Win.Malware.Generic-9880784-0
Create hunting rule

Win.Malware.Generic-9880785-0
Create hunting rule

Win.Malware.Generic-9880807-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b7fd97e-ed9e-4ab3-90b0-9a8e1e839322
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820808
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4/
Threat name:
Win32.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 03:26:31 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o57ajjdsulutr4p5qw3i57tmsbza3cm2ryahoafj3p6dqvu2hhca._file
Verdict:
malicious
Similar samples:
2dea3932c1757b97794f9695077e24ac9c303be27f714d60649d0c10a806c954
RaccoonStealer
41a0994823dcd4c0556cffa6f62e8ef68ccc30575f7c0c5769eb0ec312d6d370
RaccoonStealer
4c13f894dc3fedf1f1a0388cbdd003803e6addf8e1a666bea37fbb03aac865f8
RaccoonStealer
572f68d6d174b6a758ad3f0c4a7cedc51431c629b5419222101ab6f5ba2fc255
RaccoonStealer
865e5da4d6d27498a82f1cf6ef3b3becebf47887045999d73ce05a00131b5fe6
RaccoonStealer
8990e30dc8b1ed034d76dd4997dd9cefe06b0a731d44edeafe8dd1e4dabb6347
RaccoonStealer
a02b64dc93daa45710a48d618f107e0ad5ac36b1b4ec65dfffa5b9a217f3364f
RaccoonStealer
ca2edb79a9c558fcc52a3ce5b3767dadf832036a260f9aad37bf2cfb2725c52a
RaccoonStealer
ee22929b148bbbc5527e628d58085c517b34f546f6d06625a6e81f030f8e5d89
RaccoonStealer
f97fc1542ab5f62402203c2e36ce0b8984ae68545b575ae160bb14caf53f2803
RaccoonStealer
+ 1'669 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210723-kztdfmgt4j/
Behaviour
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Modifies system certificate store
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
fd34bb80cd2642402f1ebf9b2e3b9bbf2b7e26d654dd0d7102a527a6535eb9fd
MD5 hash:
613731ab8c536d7f17415db88b093c18
SHA1 hash:
8eea7274b1094cffc0d61e2ae24581847bf9896b
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/8a039070-4e09-44c7-9b28-759fa5e8cf31/
Parent samples :
5f961bb251b5cced26c85957ba0c0b2f74a1f7c0a1edd2095c5b8c4bfb344b44
d2bab01fe3f3615831a146acbe0b099deb680545132eb28a0f1e42e37aa3870b
9a89d59fd9fc97f37e19fd750bff125617632780fe9061aebd5988037e0101ba
145793398014dea6cf0cdb29c644cc1156cccf80949bbd6a013237b9481a6451
ee22929b148bbbc5527e628d58085c517b34f546f6d06625a6e81f030f8e5d89
a02b64dc93daa45710a48d618f107e0ad5ac36b1b4ec65dfffa5b9a217f3364f
4c13f894dc3fedf1f1a0388cbdd003803e6addf8e1a666bea37fbb03aac865f8
2dea3932c1757b97794f9695077e24ac9c303be27f714d60649d0c10a806c954
f97fc1542ab5f62402203c2e36ce0b8984ae68545b575ae160bb14caf53f2803
e3168c6e143525f0604f8e6a81dda4e8c485b8f96e9c94638d97c8db272b7936
41a0994823dcd4c0556cffa6f62e8ef68ccc30575f7c0c5769eb0ec312d6d370
865e5da4d6d27498a82f1cf6ef3b3becebf47887045999d73ce05a00131b5fe6
ca2edb79a9c558fcc52a3ce5b3767dadf832036a260f9aad37bf2cfb2725c52a
572f68d6d174b6a758ad3f0c4a7cedc51431c629b5419222101ab6f5ba2fc255
8990e30dc8b1ed034d76dd4997dd9cefe06b0a731d44edeafe8dd1e4dabb6347
777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4
cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036
52db6bc60a654f5eaf0c9c85646df732803a058f0c55f1782c6e61de692fef10
2db7b2e33ee548da42c807ee9a9526274db41bf6a23312e2829f2ca5593914b2
dd9ed65eb3bd99b6627c940b7de0a44cf06ef5ae4cfb68aae7897bf2e42db528
45c7559f4e8ca5536943f7b61a57ef0f4c7917507490c771d0b7d85bef89d92f
37137c97a81252bf7a3653ca231b1ac8653d99d6df4d24597f1a09eaefd3072b
449e6629db78334ee22d55526c2b4b6ac5842948b86486e8b5cd6197518389c4
aba364467d21e100381db1e20d17ef011353050a14dd863cc79ad601debe0343
cada28cf855a9059f761e89e4441797a92aed1e4a5878c2e87171090295dcaea
3767b2aa5033d8a966e8217dec4af05cc994b76347411b41599e3e4309ea3d98
f5be0ec35ef75583d71757fee81cff2d190b06fcf5dcd3683ebc2959472556db
c9459ace7e2f1d2e5a8a2afb4c3b6ab8cc88a0c2ca0d9781c045cc86ef36e6c8
4acbafb8a79411abf461bc4ebe4ad1efe4abe663adcd7972588f6e98715217d8
35ef835c77b1e02e025da29a69effd42fe689876819ad90b159de8b32d64c96e
f5ce1abb61275e3402f49f48e8094bd2aa038f03845c41e2b7f570c66666794a
SH256 hash:
777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4
MD5 hash:
d42ac5ff77d588426a1affbccecb472d
SHA1 hash:
2454224b70016a92924d0310c1f3c189eb925001
Link:
https://www.unpac.me/results/8a039070-4e09-44c7-9b28-759fa5e8cf31/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1470649/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1470792/
Cape
Cape
https://www.capesandbox.com/analysis/173652/

Comments