MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272
SHA3-384 hash: f4aac39c5986aacf93ee9bcb15bcc52bf4c8857608389e99b0b4e7211f445fc19beb0af5451e16d5cafd8c78625da259
SHA1 hash: a3e9e3f2c8ddacc6ba7c818ae7533c765e06180f
MD5 hash: a5a76b4bf31b1e1312c72aa0382cf64d
humanhash: magnesium-single-queen-leopard
File name:a5a76b4bf31b1e1312c72aa0382cf64d.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:184'320 bytes
First seen:2021-08-13 07:57:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 21f8cbe210ac78e50bb44fcc94551c73 (7 x RaccoonStealer, 2 x ArkeiStealer, 1 x Smoke Loader)
ssdeep 3072:deD8VM8wtvGcZmuTDsD5N8a4ROzcLztCZA9:dBo4uAOROzcL5Ci
Threatray 4'413 similar samples on MalwareBazaar
TLSH T1C2049DD2B893E47EC091D9F024A197B42765E8205614058FA69C3F2F1E3B2E352FE3D6
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://45.67.231.40/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.67.231.40/ https://threatfox.abuse.ch/ioc/184315/

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a5a76b4bf31b1e1312c72aa0382cf64d.exe
Verdict:
No threats detected
Analysis date:
2021-08-13 08:17:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f73b8f38-7f51-465e-b581-f87c442925be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178881/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.60219.2164.13916.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Running batch commands
Query of malicious DNS domain
Connection attempt to an infection source
Deleting of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Launching a file downloaded from the Internet
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06f2b169-60a5-4f40-9725-421bf6c153a3
Result
Threat name:
Raccoon SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/832288
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Drops PE files to the startup folder
Found C&C like URL pattern
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected Raccoon Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 464740 Sample: mcQMknyBg0.exe Startdate: 13/08/2021 Architecture: WINDOWS Score: 100 68 www.wisebarber.com 2->68 70 www.smsmaja.com 2->70 72 737 other IPs or domains 2->72 102 Multi AV Scanner detection for domain / URL 2->102 104 Antivirus detection for URL or domain 2->104 106 Multi AV Scanner detection for dropped file 2->106 110 8 other signatures 2->110 11 mcQMknyBg0.exe 2->11         started        14 ubhdagj 2->14         started        signatures3 108 Performs DNS queries to domains with low reputation 70->108 process4 signatures5 126 Detected unpacking (changes PE section rights) 11->126 128 Contains functionality to inject code into remote processes 11->128 130 Injects a PE file into a foreign processes 11->130 16 mcQMknyBg0.exe 11->16         started        19 ubhdagj 14->19         started        process6 signatures7 94 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 16->94 96 Maps a DLL or memory area into another process 16->96 98 Checks if the current machine is a virtual machine (disk enumeration) 16->98 21 explorer.exe 13 16->21 injected 100 Creates a thread in another existing process (thread injection) 19->100 process8 dnsIp9 74 91.241.19.52, 49762, 80 REDBYTES-ASRU Russian Federation 21->74 76 185.142.98.122, 49761, 49767, 80 MGNHOST-ASRU Russian Federation 21->76 78 6 other IPs or domains 21->78 50 C:\Users\user\AppData\Roaming\ubhdagj, PE32 21->50 dropped 52 C:\Users\user\AppData\Local\Temp\290C.exe, PE32 21->52 dropped 54 C:\Users\user\...\ubhdagj:Zone.Identifier, ASCII 21->54 dropped 56 4 other files (none is malicious) 21->56 dropped 112 System process connects to network (likely due to code injection or exploit) 21->112 114 Benign windows process drops PE files 21->114 116 Performs DNS queries to domains with low reputation 21->116 118 4 other signatures 21->118 26 290C.exe 3 21->26         started        28 explorer.exe 8 21->28         started        32 21D8.exe 2 21->32         started        34 8 other processes 21->34 file10 signatures11 process12 dnsIp13 37 290C.exe 26->37         started        42 290C.exe 26->42         started        86 readinglistforjuly2.xyz 28->86 132 System process connects to network (likely due to code injection or exploit) 28->132 134 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 28->134 136 Tries to steal Mail credentials (via file access) 28->136 138 2 other signatures 28->138 88 207.244.227.123 CONTABOUS United States 32->88 90 107.152.39.165 TZULOUS United States 32->90 92 216 other IPs or domains 32->92 44 cmd.exe 32->44         started        48 C:\ProgramData\Runtimebroker.exe, PE32 34->48 dropped file14 signatures15 process16 dnsIp17 80 45.67.231.40, 49769, 80 SERVERIUS-ASNL Moldova Republic of 37->80 82 195.201.225.248, 443, 49768 HETZNER-ASDE Germany 37->82 84 telete.in 37->84 58 C:\Users\user\AppData\...\vcruntime140.dll, PE32 37->58 dropped 60 C:\Users\user\AppData\...\ucrtbase.dll, PE32 37->60 dropped 62 C:\Users\user\AppData\...\softokn3.dll, PE32 37->62 dropped 66 56 other files (none is malicious) 37->66 dropped 120 Tries to steal Mail credentials (via file access) 37->120 122 Tries to harvest and steal browser information (history, passwords, etc) 37->122 64 C:\Users\user\AppData\...\svchostsw.exe, PE32 44->64 dropped 124 Drops PE files to the startup folder 44->124 46 conhost.exe 44->46         started        file18 signatures19 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-08-13 03:25:57 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmzcqf5lfkymogah4qlj4qn5jgkugkfe7h7rb6x3c3urxgu5cjza._file
Verdict:
suspicious
Similar samples:
4a1f935a5f94e5b3d7d0c79dcd01a96d69650bfeadc4a49d6548b118e82e1e16
RaccoonStealer
5d2140c3ab1944f381206aa8d5c3ae0e5c2dad60751d3a2f631b1b08a810baa2
RaccoonStealer
76526cd30725afafe90b7f19fbb607571ac7f827aece34bf1d1cc41c595f2a93
RaccoonStealer
a3eaf45cf366908149a9143b9426bfa6c3dacca3ffb910031c2d7d65fa51fd0d
RaccoonStealer
cc700e4575649a012895b044f54ba9b8e87ea47efdeb755f32f135317451610d
RaccoonStealer
d1697994428238aced8ff24acff0b131d9737a0659a81e4a7395a746c5ce353e
RaccoonStealer
d3849946eb2dd2aa6bebcddb30751a4a99bc05ee5011db3f5081df2f970a1854
RaccoonStealer
f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
RaccoonStealer
fe74f3ee571f291acdaa6d0546bc16e7d5feb3ca1bd6ad1fb3c74b73483b871b
RaccoonStealer
fff093b2593add9b7f59377b88e4e9586a8b728d82df197aad087d7e95615fd9
RaccoonStealer
+ 4'403 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader botnet:471c70de3b4f9e4d493e418d1f60a90659057de0 botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion infostealer persistence phishing spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/210813-ra368l9xsx/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Detected phishing page
Modifies Windows Defender Real-time Protection settings
Raccoon
Raccoon Stealer Payload
RedLine
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
Malware Config
C2 Extraction:
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Dropper Extraction:
http://193.56.146.55/Api/GetFile2
Unpacked files
SH256 hash:
8b085611ecc9d6df0bc54d8421e57eb82f70c2c085e488ccfb41b4d26560bc57
MD5 hash:
3dff4690ed57aba1cd05faf0e7d2ec18
SHA1 hash:
feda1fc6459b5391f3a56da56d9da8089944df5b
Link:
https://www.unpac.me/results/7d4e8408-8489-47cf-98de-da21236e3464/
SH256 hash:
7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272
MD5 hash:
a5a76b4bf31b1e1312c72aa0382cf64d
SHA1 hash:
a3e9e3f2c8ddacc6ba7c818ae7533c765e06180f
Link:
https://www.unpac.me/results/7d4e8408-8489-47cf-98de-da21236e3464/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7b322817ab2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 7b322817ab2ab0c71807e4169e41bd49954328a4f9ff10fafb16e91b9a9d1272

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1476557/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178881/

Comments