MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aa7a5eb1247b0d54b2bd29dd6b2d563ca30da4990c8220f61da826fe5941452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	8aa7a5eb1247b0d54b2bd29dd6b2d563ca30da4990c8220f61da826fe5941452
SHA3-384 hash:	aeab11076e0d0901a00e5cbbcba89a25c68fa8ace783c25d19319a89ae5054467b7d96835df9c5406032c2d363cf14e4
SHA1 hash:	7e63b27c4c3f3708bd14aa3e394a074b15b2c8dc
MD5 hash:	affa8586bb8f072003d20117b614ea37
humanhash:	georgia-yellow-burger-idaho
File name:	affa8586bb8f072003d20117b614ea37.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	776'192 bytes
First seen:	2020-06-15 14:17:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:0FrsKZ/5KRSgQaKMXPmasxBu4sZ0Ay8iGyjvsAc1Wc+wD37gMDI6W:1KB5Wb11fm3xmby8Wvzc+KLNx
Threatray	331 similar samples on MalwareBazaar
TLSH	5AF4120937EE5F24D0BE1B3585F1990043B0B8AA6A13FB8E1FC0709D15B6BD59942F6B
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10509/

Detection(s):

SecuriteInfo.com.Generic.mg.affa8586bb8f0720.18897.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2020-06-15 10:47:13 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rkt2l2ysi6ynkszl2ko5nmwvmpfdbwsjsdeced3b3kbg7zmucrja._file

Verdict:

malicious

RaccoonStealer

68f66dd88b1a69a8ff2e63cca5e4554e1b147ccd2474d356b60a749c21412fd4

RaccoonStealer

6fa66f7851bea577cc6adfda11d3225a69b7c6554f028851eddd4d23ea074a59

RaccoonStealer

7294bdc3333d08ac9c2397b3555c0126928c13600b23de09f21841cfee83f55a

RaccoonStealer

7d02ae5ae3ed3b7a13ff5495174216ea3195764d7154b8e9b4997c74fd08fb09

RaccoonStealer

82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639

RaccoonStealer

862b45e2c98a175f625797db1d3342e0d9dc35b79e3386deb42c06b1918867d9

RaccoonStealer

b30f264fda73db6970c313776095289e5fc0ee77f6be19010e2f9e125205e845

RaccoonStealer

bcb474ac919440674135c673d8c6a0fc8015a63a15b2849c3346f74a716b5249

RaccoonStealer

e04977f7d1fbf8b3a69237bbd2170af6c3046a8ce29e2732cd7c72f079f0e0f8

RaccoonStealer

+ 321 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-5phtyyzsf2/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

ServiceHost packer

Suspicious use of NtCreateProcessExOtherParentProcess

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_raccoon_a0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator