MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 910f95e7c558189f93ecba183395201ca5887303b5968c8e4a5c0301fdd3e008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 9

Intelligence 9 IOCs 1 YARA File information Comments

SHA256 hash:	910f95e7c558189f93ecba183395201ca5887303b5968c8e4a5c0301fdd3e008
SHA3-384 hash:	ad8972d9b53a43ef9e46c05a5ce8121ef2b29fb209e0e71ab198a02bd06faef3cdb6e7665001ee069d27a38c04378fc1
SHA1 hash:	cfb616e238700baee6451f7dce84631360ce6da1
MD5 hash:	13c79b9cb9be286b71e0f529ad3b9402
humanhash:	winner-five-london-spring
File name:	13c79b9cb9be286b71e0f529ad3b9402.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	348'672 bytes
First seen:	2021-11-06 07:46:04 UTC
Last seen:	2021-11-06 10:22:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	84b6df72a9e01c91bfab46c99e26b87e (3 x RedLineStealer, 2 x RaccoonStealer, 1 x Smoke Loader)
ssdeep	6144:wmCeORYD+CyeIWr3T0AU2trculWesRS/HQxNDUXQ31YqnE:wmCHRmlyeFTlUgrllRsRS/HQxNz9n
TLSH	T16B748C00A7B1C039F5B252F879B5A3A9B53A7DA1AB7440CF53D52AEE56346E0EC71303
File icon (PE):
dhash icon	b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
65.108.55.203:56717

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
65.108.55.203:56717	https://threatfox.abuse.ch/ioc/244568/

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/202871/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.47341195.8164.17507.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware tofsee

Link:

https://www.filescan.io/uploads/618632c0d8143ea269ccf60a/reports/5518f2a8-e4f1-4318-aee5-89ab22b0cf7f/overview

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f7df956b-843d-4d3a-bfcf-e5a2e621f895

Result

Threat name:

RedLine SmokeLoader Tofsee

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/884461

Signature

.NET source code contains very large array initializations

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

DLL reload attack detected

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/910f95e7c558189f93ecba183395201ca5887303b5968c8e4a5c0301fdd3e008/

Threat name:

Win32.Trojan.Phonzy

Status:

Malicious

First seen:

2021-11-05 20:01:36 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sehzlz6flamj7e7mximdhfjadssyq4ydwwlizdsklqbqd7ot4aea._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:redline family:smokeloader family:tofsee family:xmrig botnet:23435346346 botnet:superstar backdoor discovery evasion infostealer miner persistence spyware stealer trojan

Link:

https://tria.ge/reports/211106-jlztrabbgr/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Enumerates physical storage devices

Launches sc.exe

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Loads dropped DLL

Deletes itself

Sets service image path in registry

Modifies Windows Firewall

Executes dropped EXE

Downloads MZ/PE file

Creates new service(s)

XMRig Miner Payload

xmrig

Windows security bypass

Tofsee

SmokeLoader

RedLine Payload

RedLine

Malware Config

C2 Extraction:

http://hefahei60.top/
http://pipevai40.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
quadoil.ru
lakeflex.ru
93.115.20.139:28978
185.215.113.29:36224