MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
SHA3-384 hash: 2fb9089d9e57bf60ef7b0bcbb1ed4f7f6581a7619acc5f7674fcea03da1d2c22baf1fae2f870f0d1ffd378db019cdc76
SHA1 hash: 464c2ede535b9b20a4a78c70ba1bc42d7a2881f6
MD5 hash: ccc61ab8808223222d72075ef05824bd
humanhash: mike-maine-wolfram-alabama
File name:8eef033f451d0f80979ba8cfdcd79677c475cf34a8337.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:497'152 bytes
First seen:2021-09-21 11:55:49 UTC
Last seen:2021-09-21 13:16:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 019bced73b51911db702af2d47c34cb7 (6 x RaccoonStealer, 2 x ArkeiStealer, 2 x Stop)
ssdeep 12288:Dn5fNE4KqOmutSvfUCq25T/ZOcQNwpMjRCzegsG87A5ptWGBai:lHNOmBvfUK/ZO5NnCzBsG8c5Hh
Threatray 3'170 similar samples on MalwareBazaar
TLSH T103B401003BB0C671D29356310B27E7B0A9B6B9612E7193873B56F67DAF302D0766731A
File icon (PE):PE icon
dhash icon 327a7c7d727e6e76 (7 x RaccoonStealer, 4 x RedLineStealer, 1 x DanaBot)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.53.46.105/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.53.46.105/ https://threatfox.abuse.ch/ioc/224184/

Intelligence

File Origin
# of uploads :
2
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 11:58:58 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/3607b2bd-7ecd-4305-831d-0d72b96c6a2d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189856/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.6169.5249.UNOFFICIAL
Create hunting rule

Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2bef441-7598-4a6c-baf5-9b647b08269c
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/854844
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 11:56:08 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3xqgp2fduhybf43vdh5zv4wo7chltzuvazxyvfpc2ev3355rc3a._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0597fec78019b2f9914df4a6c7f5a54eb0129ffb527bf9e7a144246ff6130eba
RaccoonStealer
0ebf095d8bc7029868cd05f7ad20f51c324755881ade188d88ba8ed94d67f788
RaccoonStealer
2b2394b8ecbee2ffe037f5eb6912ce33e6a1800a7c2ab772d2136e55dcad5693
RaccoonStealer
3155e0baf18b8369f71e1cf4407774a78d13ae881a70c4083c02920354b4137c
RaccoonStealer
44bc3362221be1888156d1a7d5c29490a2c449d6cabe6766ecb6878500562057
RaccoonStealer
8305a87ead1a68264f4d0f691a4314f86c3b2bdd909d01028219e0d480238cfa
RaccoonStealer
af90943b5aa1d71230b58094b949a95bf1dd776130e5740b4e9325cf17e94efb
RaccoonStealer
ce7fb6b222f840a7af7d162d6726316e882d57fc1a46f35a53b90e030b0b208b
RaccoonStealer
d4a432f1248930343a999a11dbcf5c7790f7c0d4856200aba7d20f956455fa2e
RaccoonStealer
e9d0565443dbb2553948e2a89bb580a81470a00ac3108ecb1e67a5a121e9d65c
RaccoonStealer
+ 3'160 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon discovery spyware stealer
Link:
https://tria.ge/reports/210921-n316cshde8/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of WriteProcessMemory
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Unpacked files
SH256 hash:
2b846276cddcb96a51df3052f4f63232f4a9615e08df959342185ed0255c3f0c
MD5 hash:
6f5936f1ebe731d1069daa1b20473a6f
SHA1 hash:
e83bd74f6ebb2b095cffb5f534c3ad1d0017c7c3
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/6cd13ffe-a470-4abe-99da-7db06b1f2dbf/
Parent samples :
d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768
39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7
7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332
77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a
f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb
d720677c3d1ae4e2048fba7ff9a80839affa35f45f6abd2643b0de4a0f9bc997
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
SH256 hash:
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
MD5 hash:
ccc61ab8808223222d72075ef05824bd
SHA1 hash:
464c2ede535b9b20a4a78c70ba1bc42d7a2881f6
Link:
https://www.unpac.me/results/6cd13ffe-a470-4abe-99da-7db06b1f2dbf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189856/

Comments