MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708
SHA3-384 hash: 37d10162a79653b8154efc99c6a7f97f1bf727009bf591941725aea8f6a775eb73d3ab58dc7409f31694a763ef352387
SHA1 hash: 4a5d999c5b005cc998d03a2681fe0c9a101f54fe
MD5 hash: b142d5ad33a2a55279143631a4908e3a
humanhash: fillet-sixteen-robin-fifteen
File name:b142d5ad33a2a55279143631a4908e3a.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:565'248 bytes
First seen:2021-10-29 08:52:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 225e0ad40cbe89f68a30c3a6a7705729 (2 x RaccoonStealer, 1 x Stop, 1 x CryptBot)
ssdeep 12288:qqpNhD5ulkBEqavVwvhp+IIIUkng7PI4OGFF77kc5zO/wobrN:qqpNR5ThaNmhp+I75nkRVTUQKoyr
Threatray 3'934 similar samples on MalwareBazaar
TLSH T1A1C4E000A7F0C035F5B727F54AB99368A93E7AA16B3894CF53D516EA86346E0EC31317
File icon (PE):PE icon
dhash icon aad8ac9cc6a68ee0 (34 x RedLineStealer, 14 x RaccoonStealer, 11 x Smoke Loader)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://194.180.174.181/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.180.174.181/ https://threatfox.abuse.ch/ioc/239344/

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b142d5ad33a2a55279143631a4908e3a.exe
Verdict:
Malicious activity
Analysis date:
2021-10-29 15:48:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/939da6d2-7473-4922-8646-f601870947eb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Trojan.Generic-9903804-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a0d0933a-8695-46e2-b143-41216d4c938a
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/879177
Signature
Found detection on Joe Sandbox Cloud Basic with higher score
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 22:56:11 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pe3kvaoanyrkzrrxhyvnhpxrwbnnpwvt7hzxcjepfi3i6jqwm4ea._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
3afaf87525ac2bbcc1a82d67fa3906d82ed0a22ad46514cee2ce471e6e3da11f
RaccoonStealer
4bde3d5a9fa931f8349af0512237db307760ea6a264351e4bfab3f66cf81a06e
RaccoonStealer
58524862222e01692b89045f1a8c41cd7c90c31fdb7a8de92ef3b65ef723bb44
RaccoonStealer
64771bf8e0a5d9626795cf4f1172cfaed594ce61defb10f9057fd14e83dff4c5
RaccoonStealer
74816f56b7e8ada613ca8151c4d904e0e603019502382493d70138d7c6cda410
RaccoonStealer
87405f0c17c7ccda1c89b260266217bebcc2f77cfa8bde35b90984af0f0b28a1
RaccoonStealer
+ 3'924 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:a7a7651f160522c3eb3c593186fb8a026774778c stealer
Link:
https://tria.ge/reports/211029-kta12ahgbj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
04dbba9c00636bc5cd88c52c645ea36f22f0b8b74cfc9f80d4e255ce2d4c0232
MD5 hash:
784a057c4bbab6a877dee42772acb2d3
SHA1 hash:
51c65fa67cc5f6ee515c413d9081c25d728df896
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/4b72ffbd-b4b9-4c7c-8737-15e1f8483be1/
SH256 hash:
7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708
MD5 hash:
b142d5ad33a2a55279143631a4908e3a
SHA1 hash:
4a5d999c5b005cc998d03a2681fe0c9a101f54fe
Link:
https://www.unpac.me/results/4b72ffbd-b4b9-4c7c-8737-15e1f8483be1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments