MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f
SHA3-384 hash: 99fdea2485a7dad01b929c628d73a5b1a1ff30b479e5859ad5b184e3c1f2f2532f4b36a84600d4d8033a98fa4493271f
SHA1 hash: 41cbef358e965ca8a0e76e682c84abf3c2776e9d
MD5 hash: 9d6933a15b542014eabeecddd013fda1
humanhash: white-steak-tango-triple
File name:9d6933a15b542014eabeecddd013fda1
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:567'296 bytes
First seen:2021-11-18 07:17:06 UTC
Last seen:2021-11-18 09:21:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f1127f86499f6cda40cf38ebb837b1f (4 x RedLineStealer, 1 x RaccoonStealer)
ssdeep 12288:HLGQiID9fAHptNZrH5yW1+557sjuu5yGI/xMwZ4nZ25Xtmf:HLSokH5b1+MjP0xr4n45u
Threatray 1'365 similar samples on MalwareBazaar
TLSH T1DDC47D06B690C072D9730875C9B6A6B2DA3D3C24873496DFA7D43E392F717C0A93971A
File icon (PE):PE icon
dhash icon 334b7373630b869a (6 x RedLineStealer, 1 x Amadey, 1 x RaccoonStealer)
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2021-11-18 01:38:05 UTC
Tags:
evasion trojan loader opendir rat redline stealer
Link:
https://app.any.run/tasks/3a1a363d-27aa-434a-a4f5-0589779db770

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/207108/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.44587.18565.17900.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending an HTTP GET request
Creating a file
DNS request
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Connecting to a non-recommended domain
Creating a window
Running batch commands
Changing a file
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Launching a process
Launching cmd.exe command interpreter
Blocking the Windows Defender launch
Query of malicious DNS domain
Unauthorized injection to a recently created process
Launching a tool to kill processes
Sending a TCP request to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware wacatac zusy
Link:
https://www.filescan.io/uploads/6195fe2b2695a62af9f2ce2b/reports/c6261e81-8e05-4059-877d-e5c8c40650ad/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53b7baf1-262d-4a46-9480-147a8e3a1c70
Result
Threat name:
Cookie Stealer SmokeLoader Socelars
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/891743
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect sleep reduction / modifications
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Disable Windows Defender real time protection (registry)
Downloads files with wrong headers with respect to MIME Content-Type
Found C&C like URL pattern
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
May check the online IP address of the machine
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Query firmware table information (likely to detect VMs)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Cookie Stealer
Yara detected SmokeLoader
Yara detected Socelars
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 524216 Sample: ikeokicy4x Startdate: 18/11/2021 Architecture: WINDOWS Score: 100 106 142.250.186.46 GOOGLEUS United States 2->106 172 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->172 174 Antivirus detection for URL or domain 2->174 176 Antivirus detection for dropped file 2->176 178 14 other signatures 2->178 10 ikeokicy4x.exe 4 27 2->10         started        15 rundll32.exe 2->15         started        signatures3 process4 dnsIp5 118 212.193.30.21, 49759, 49780, 49802 SPD-NETTR Russian Federation 10->118 120 www.tueurdevirus.com 103.155.93.165, 49791, 80 TWIDC-AS-APTWIDCLimitedHK unknown 10->120 122 12 other IPs or domains 10->122 80 C:\Users\...\ymmlYcngIIPGli1vm7hbJRgP.exe, PE32 10->80 dropped 82 C:\Users\...\h5mc6RqESUl8ylmJAWBny3Qh.exe, PE32 10->82 dropped 84 C:\Users\...\fVuMvwug39pHVKOvwo6BrDrD.exe, PE32 10->84 dropped 86 7 other files (6 malicious) 10->86 dropped 188 May check the online IP address of the machine 10->188 190 Disable Windows Defender real time protection (registry) 10->190 17 h5mc6RqESUl8ylmJAWBny3Qh.exe 2 10->17         started        21 fVuMvwug39pHVKOvwo6BrDrD.exe 10->21         started        23 ymmlYcngIIPGli1vm7hbJRgP.exe 2 10->23         started        27 2 other processes 10->27 25 rundll32.exe 15->25         started        file6 signatures7 process8 dnsIp9 64 C:\Users\...\h5mc6RqESUl8ylmJAWBny3Qh.tmp, PE32 17->64 dropped 146 Obfuscated command line found 17->146 30 h5mc6RqESUl8ylmJAWBny3Qh.tmp 3 19 17->30         started        148 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->148 150 Maps a DLL or memory area into another process 21->150 152 Checks if the current machine is a virtual machine (disk enumeration) 21->152 34 explorer.exe 21->34 injected 37 ymmlYcngIIPGli1vm7hbJRgP.exe 3 23->37         started        39 conhost.exe 23->39         started        154 Contains functionality to infect the boot sector 25->154 156 Contains functionality to inject threads in other processes 25->156 158 Contains functionality to inject code into remote processes 25->158 160 5 other signatures 25->160 41 svchost.exe 25->41 injected 43 svchost.exe 25->43 injected 45 svchost.exe 25->45 injected 49 4 other processes 25->49 124 iplogger.org 5.9.162.45, 443, 49797 HETZNER-ASDE Germany 27->124 126 www.listincode.com 149.28.253.196, 443, 49796 AS-CHOOPAUS United States 27->126 128 192.168.2.1 unknown unknown 27->128 66 C:\Users\...\pidHTSIGEi8DrAmaYu9K8ghN89.dll, PE32+ 27->66 dropped 47 WerFault.exe 23 9 27->47         started        file10 signatures11 process12 dnsIp13 132 fouratlinks.com 66.29.140.147, 49801, 80 ADVANTAGECOMUS United States 30->132 88 C:\Users\user\AppData\Local\...\lakazet.exe, PE32 30->88 dropped 90 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 30->90 dropped 92 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 30->92 dropped 94 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 30->94 dropped 51 lakazet.exe 30->51         started        134 188.172.93.164 VFM-ASVodafoneMaltaLtdASMT Malta 34->134 136 1.248.122.240 SKB-ASSKBroadbandCoLtdKR Korea Republic of 34->136 144 4 other IPs or domains 34->144 96 C:\Users\user\AppData\Roaming\jjgchhr, PE32 34->96 dropped 98 C:\Users\user\AppData\Local\Temp\C910.exe, PE32 34->98 dropped 100 C:\Users\user\AppData\Local\Temp\B289.exe, PE32 34->100 dropped 104 2 other malicious files 34->104 dropped 162 Benign windows process drops PE files 34->162 164 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->164 138 104.21.24.175, 443, 49798 CLOUDFLARENETUS United States 37->138 140 56.jpgamehome.com 172.67.219.219, 443, 49795 CLOUDFLARENETUS United States 37->140 102 C:\Users\user\AppData\Local\Temp\sqlite.dll, PE32 37->102 dropped 56 conhost.exe 37->56         started        166 System process connects to network (likely due to code injection or exploit) 41->166 168 Sets debug register (to hijack the execution of another thread) 41->168 170 Modifies the context of a thread in another process (thread injection) 41->170 58 svchost.exe 41->58         started        142 20.189.173.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 47->142 file14 signatures15 process16 dnsIp17 108 162.255.117.78 NAMECHEAP-NETUS United States 51->108 110 162.0.210.44 ACPCA Canada 51->110 68 C:\Users\user\AppData\...\Kyjokelufu.exe, PE32 51->68 dropped 70 C:\Users\user\AppData\...\Kukacoserae.exe, PE32 51->70 dropped 72 C:\Program Files\...\foldershare.exe, PE32 51->72 dropped 78 4 other malicious files 51->78 dropped 180 Antivirus detection for dropped file 51->180 182 Machine Learning detection for dropped file 51->182 60 Kyjokelufu.exe 51->60         started        112 208.95.112.1 TUT-ASUS United States 58->112 114 toa.mygametoa.com 34.64.183.91 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 58->114 116 104.21.75.46 CLOUDFLARENETUS United States 58->116 74 C:\Users\user\AppData\...\Login Data.tmp, SQLite 58->74 dropped 76 C:\Users\user\AppData\Local\...\Cookies.tmp, SQLite 58->76 dropped 184 Query firmware table information (likely to detect VMs) 58->184 186 Tries to harvest and steal browser information (history, passwords, etc) 58->186 file18 signatures19 process20 dnsIp21 130 142.250.185.132 GOOGLEUS United States 60->130 192 Machine Learning detection for dropped file 60->192 signatures22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 07:18:06 UTC
AV detection:
16 of 44 (36.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhgvd7di253ni5dymvrgxa6l7tphwejdq6433tiu7dwz2cyb7chq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3badebcefb9e7153384cae83baaa119f6317c9381e8500ac285568590e0abd82
RaccoonStealer
4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7
RaccoonStealer
59716b314ba0d53b7e8de32a73af01b7b383834bf038c3bcaa8f7d07afc8b280
RaccoonStealer
62cf8452627f42cc0f5655a12ef386c720e11f2fd2ad7ec64ea821184ffacc65
RaccoonStealer
73c1188d93bd4318a830cb6d891aae7580a61c396ce37ba3676a321bbd3a137e
RaccoonStealer
84b57d3d7fdabaebcd85cf01dbf14b9cb94e08fe081abcb60b218c1298c55995
RaccoonStealer
b05798eab2bd214db04037519c3d5271e9602980123b594c8b579f5581d4efdd
RaccoonStealer
bb1944681aa2fcfd5f372fd44e041a63569b46130540225afc1560a1650d4e37
RaccoonStealer
ee96df216161f048ee9c50853b018f779d71bce1498f28a4d1b1bc3d797f14ac
RaccoonStealer
+ 1'355 additional samples on MalwareBazaar
Result
Malware family:
socelars
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader family:socelars backdoor discovery evasion persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/211118-h4y5habgfn/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Download via BitsAdmin
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Checks for common network interception software
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
SmokeLoader
Socelars
Socelars Payload
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
Malware Config
C2 Extraction:
http://www.gianninidesign.com/
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Unpacked files
SH256 hash:
89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f
MD5 hash:
9d6933a15b542014eabeecddd013fda1
SHA1 hash:
41cbef358e965ca8a0e76e682c84abf3c2776e9d
Link:
https://www.unpac.me/results/6e7f3d4b-911a-4341-b62c-0dbd29432a66/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/89cd51fc68d7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_DLInjector06
Create hunting rule
Author:ditekSHen
Description:Detects downloader / injector
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1799095/
Cape
Cape
https://www.capesandbox.com/analysis/207108/

Comments


Avatar
zbet commented on 2021-11-18 07:17:08 UTC

url : hxxp://212.193.30.29/download/Cube_WW14.bmp