MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5
SHA3-384 hash: 9d8278b7137a47025812ed254012983ef35559f41496d75b5a61eef05a07a1c4332c300c773e755bce75e8275439e455
SHA1 hash: 755efc85945ece280bd6ecb194daea2833d1c7a3
MD5 hash: b234696a063259c2a5ff15957478b99b
humanhash: harry-snake-nuts-solar
File name:b234696a063259c2a5ff15957478b99b.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'151'640 bytes
First seen:2022-03-10 17:01:02 UTC
Last seen:2022-03-10 18:36:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 24576:z+ZZG0KskNvWBtSOQnjIw3CE/uuq1o8HDYXA8kEaHNYK3Mr5FuD0G:zIZEsi+BYOIj3CyYYX3Nay5gDR
TLSH T1B43533B7F986FCD9C7A8A1F8F914DD19A113E75A83C72F1991691841188CCB1394EB3C
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://91.219.236.212/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://91.219.236.212/ https://threatfox.abuse.ch/ioc/393367/

Intelligence

File Origin
# of uploads :
2
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249202/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending an HTTP GET request
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/622a2ed5dfdfa8501c86fbc7/reports/29abe73a-328d-4912-a090-c231a1b47bea/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aa141b1d-602a-4eb8-b28a-a852d991998f
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/954407
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5/
Threat name:
Win32.Infostealer.Racoon
Create hunting rule
Status:
Malicious
First seen:
2022-03-07 16:18:00 UTC
File Type:
PE (Exe)
AV detection:
20 of 42 (47.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=phqvs2mur32bylvjvf2t55wisdmrpe3s476d5kxlss7qmhzc4dkq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220310-vjkslahbb7/
Behaviour
Program crash
Unpacked files
SH256 hash:
30463604b63968ee6fe761ff25f581b52ecfe4b9e310133b4572a7d746d68aae
MD5 hash:
816e8e4e48bc85d94db7a5b738f67294
SHA1 hash:
25f9963195b2d582d1c23adb4750d5093f05b601
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/b991f2a1-a1d7-4cb0-8e8c-ac5cb078a1b3/
SH256 hash:
96384093383fe1eb4fc3a2a1f80be68b9afbaf0c6e7034e0e4649590b9e6a180
MD5 hash:
cc5ed369c8fb01fbc171e28b3ad44745
SHA1 hash:
8c8e8698c3d24d454adcc211eba73f776fc462df
Link:
https://www.unpac.me/results/b991f2a1-a1d7-4cb0-8e8c-ac5cb078a1b3/
SH256 hash:
79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5
MD5 hash:
b234696a063259c2a5ff15957478b99b
SHA1 hash:
755efc85945ece280bd6ecb194daea2833d1c7a3
Link:
https://www.unpac.me/results/b991f2a1-a1d7-4cb0-8e8c-ac5cb078a1b3/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/79e15969948e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79e15969948ef41c2ea9a9753ef6c890d9179372e7fc3eaaeb94bf061f22e0d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249202/

Comments