MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81d1213774eac0f7f313388ee6206f7086cee9383c41385d717f61fd6b8fc9d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81d1213774eac0f7f313388ee6206f7086cee9383c41385d717f61fd6b8fc9d0
SHA3-384 hash: 6a26c865c8117e88979b65be5a47ee82d2ab165755cd4682942ff43e8d8c8c88e5935c7ab11621fb57ac77336cc639e3
SHA1 hash: 0d027e80282ec7df50dcdd3ee87adc41a14de616
MD5 hash: 2eede1db82c0a931e1ae84dd63500c11
humanhash: violet-mobile-maine-kansas
File name:2eede1db82c0a931e1ae84dd63500c11.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:494'592 bytes
First seen:2021-08-08 16:00:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41772127f978069b9f399090f08eba15 (4 x Smoke Loader, 3 x RaccoonStealer, 1 x DanaBot)
ssdeep 12288:eeCILmru6xV0A2+EY2DJS0ZfoAF3eCyakS+g3qOHwoO:WILmqWEVFS0gXQ+qj
Threatray 4'531 similar samples on MalwareBazaar
TLSH T1C2B402127481CB76C5214275CC35C6B0AB7BBCB58C60958B7BF87A592F322D3AB32356
dhash icon 79e0c4c8ccc4ccc0 (1 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://74.119.195.134/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://74.119.195.134/ https://threatfox.abuse.ch/ioc/166044/

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2eede1db82c0a931e1ae84dd63500c11.exe
Verdict:
Malicious activity
Analysis date:
2021-08-08 16:02:51 UTC
Tags:
trojan stealer raccoon
Link:
https://app.any.run/tasks/526dcbe7-6156-4192-bddf-fd6cfecc5af4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/177263/
Detection(s):
Win.Dropper.Babar-9883606-0
Create hunting rule

Win.Dropper.Babar-9883639-0
Create hunting rule

Win.Trojan.Generic-9883706-0
Create hunting rule

Win.Malware.Generic-9883727-0
Create hunting rule

Win.Malware.Generic-9883741-0
Create hunting rule

Win.Malware.Generic-9883748-0
Create hunting rule

Win.Malware.Raccoon-9883751-1
Create hunting rule

Win.Malware.Generic-9883752-0
Create hunting rule

Win.Malware.Raccoon-9883781-1
Create hunting rule

Win.Malware.Generic-9883783-0
Create hunting rule

Win.Malware.Generic-9883823-0
Create hunting rule

Win.Malware.Generic-9884015-0
Create hunting rule

Win.Trojan.Generic-9884137-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Connection attempt
Sending an HTTP POST request
Sending a UDP request
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/18afa9f9-7a82-4488-9338-738bebcb9b7a
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/828827
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Infostealer behavior detected
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/81d1213774eac0f7f313388ee6206f7086cee9383c41385d717f61fd6b8fc9d0/
Threat name:
Win32.Trojan.MintTitirez
Create hunting rule
Status:
Malicious
First seen:
2021-08-07 15:16:59 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhiscn3u5lapp4ythchomidpocdm52jyhratqxlrp5q7224pzhia._file
Verdict:
malicious
Similar samples:
4afb5969afd2c92b331d1fef3412103b6fa4d1ab3f386b9cf505b694038790bc
RaccoonStealer
74ce135948ae4d7c53c90befa412fad2e458fffd74df281d2f3525745a025a18
RaccoonStealer
7b874a9ec6e79839129a880e9bdbd81b3e5241d65c24acb98863e4de354606fd
RaccoonStealer
a6f0dc73e69c768ad702394dc9250700e54e3439a9adb609b119292f70200522
RaccoonStealer
c3271923866c3b970f171da75cb02a490ce5f5e1fda207e9efcc3c507d82a0be
RaccoonStealer
f5ce1abb61275e3402f49f48e8094bd2aa038f03845c41e2b7f570c66666794a
RaccoonStealer
+ 4'521 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:826994b522bdfcb5ce68df95b48acbc657312d38 stealer
Link:
https://tria.ge/reports/210808-595swpygzx/
Behaviour
Modifies system certificate store
Raccoon
Raccoon Stealer Payload
Unpacked files
SH256 hash:
fb0d7b1771affdc6a6d03240c0151f7313e6574974f7879bf2a095d9964eb088
MD5 hash:
83edc3f2fbca0ecc92bff205ec009c66
SHA1 hash:
1cf490f446462b6619354d1ccc59f225656cbf45
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/d0dbb1be-87db-410e-b9fb-5b50e1fdaef7/
SH256 hash:
81d1213774eac0f7f313388ee6206f7086cee9383c41385d717f61fd6b8fc9d0
MD5 hash:
2eede1db82c0a931e1ae84dd63500c11
SHA1 hash:
0d027e80282ec7df50dcdd3ee87adc41a14de616
Link:
https://www.unpac.me/results/d0dbb1be-87db-410e-b9fb-5b50e1fdaef7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81d1213774eac0f7f313388ee6206f7086cee9383c41385d717f61fd6b8fc9d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177263/

Comments