MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26
SHA3-384 hash: 0856c67f2a2c99adc1d1f944bba341ae29c6f6a5e031f5c045cfc627f7f3b8e5c4da607cf4d60770b4c08f651029fb35
SHA1 hash: a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392
MD5 hash: d6b2e107ac7ba9cb55fceb901651519b
humanhash: september-mexico-fourteen-skylark
File name:D6B2E107AC7BA9CB55FCEB901651519B.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:531'168 bytes
First seen:2021-08-05 21:15:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:+xNExf+83gnVZd3OOm9Fd/rL2qsdGG58D:ce28QnVZNOT9F5mGG58D
Threatray 2'010 similar samples on MalwareBazaar
TLSH T153B4F1DB7E48695ECD99427048D302B12B312C37BC02DA51ADAE311D0DBF7D5AE8F1A6
dhash icon b070a66814484494 (1 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://45.138.172.138/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.138.172.138/ https://threatfox.abuse.ch/ioc/165822/

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
D6B2E107AC7BA9CB55FCEB901651519B.exe
Verdict:
Malicious activity
Analysis date:
2021-08-05 21:19:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9908d531-0506-4fcc-9af9-ed5cd0062147

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176834/
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP POST request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6d20ae60-4ef3-45e3-9770-52285d6df9f8
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/827799
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 460227 Sample: bYD8Ez2DvI.exe Startdate: 05/08/2021 Architecture: WINDOWS Score: 88 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected Raccoon Stealer 2->45 47 2 other signatures 2->47 8 bYD8Ez2DvI.exe 1 2->8         started        process3 file4 25 C:\Users\user\AppData\...\bYD8Ez2DvI.exe.log, ASCII 8->25 dropped 49 May check the online IP address of the machine 8->49 51 Injects a PE file into a foreign processes 8->51 12 bYD8Ez2DvI.exe 82 8->12         started        signatures5 process6 dnsIp7 35 t.me 149.154.167.99, 443, 49712 TELEGRAMRU United Kingdom 12->35 37 iplogger.org 88.99.66.31, 443, 49716 HETZNER-ASDE Germany 12->37 39 45.138.172.138, 49713, 80 COMBAHTONcombahtonGmbHDE Germany 12->39 27 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->27 dropped 29 C:\Users\user\AppData\...\ucrtbase.dll, PE32 12->29 dropped 31 C:\Users\user\AppData\...\softokn3.dll, PE32 12->31 dropped 33 56 other files (none is malicious) 12->33 dropped 53 Tries to steal Mail credentials (via file access) 12->53 55 Tries to harvest and steal browser information (history, passwords, etc) 12->55 17 cmd.exe 1 12->17         started        19 rundll32.exe 12->19         started        file8 signatures9 process10 process11 21 conhost.exe 17->21         started        23 timeout.exe 1 17->23         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26/
Threat name:
Win32.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-08-01 10:55:49 UTC
AV detection:
25 of 46 (54.35%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=shvuvjmiyzqhvut7xg2d2yiwmiykejoyusvfc7lillzivnbyfita._file
Verdict:
malicious
Similar samples:
4507bfc9e523a0d650c1db2ab088af56de093bde9af54687deeaebe4a3e014c1
RaccoonStealer
4afb5969afd2c92b331d1fef3412103b6fa4d1ab3f386b9cf505b694038790bc
RaccoonStealer
667eea281435836e7fbeb42879d95a8fb41a1327a4fe6af2e696e3b767657b05
RaccoonStealer
951f38e2f0055d88433a7e1ef25d7394b34c0e7e036e990a07e97f422000d9a7
RaccoonStealer
a6f0dc73e69c768ad702394dc9250700e54e3439a9adb609b119292f70200522
RaccoonStealer
af1beafe8b2042586f291bd09192e420349c87bfaf48233c9ae5ceae4b19df4d
RaccoonStealer
f8463a32a407a7f14033c19c1c263dd28fcb3b1de8d2dbc9e07ac487770a45e8
RaccoonStealer
+ 2'000 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:92be0387873e54dd629b9bfa972c3a9a88e6726c spyware stealer
Link:
https://tria.ge/reports/210805-vvlhbv6zes/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Raccoon
Raccoon Stealer Payload
Unpacked files
SH256 hash:
2f712ed94d50b4dbc9b65a6c3ab79975bb772dc184bdbdea43170ab45b86630d
MD5 hash:
933a339e82b9f8581d54c1276b94c5b1
SHA1 hash:
5d515dbde063c96b206fffe6ba4e4b2e0bb22f72
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/2272fbba-4866-4ebc-9878-d026e71dce1d/
Parent samples :
af1beafe8b2042586f291bd09192e420349c87bfaf48233c9ae5ceae4b19df4d
3221c7c857b80fab3818cf1ea9435cef9626d84bd308d7a365e4e5089e5ef413
91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26
67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33
962793c4decea8dd718bd96ccc4209ce744414a62e4afb93c79db64df4b792e2
SH256 hash:
1bcddc720913f7548590c5f50b7f1937b823547dc8495ba7a409e2114cafaf98
MD5 hash:
5174e2184fc788bc416c4e07def8b6c5
SHA1 hash:
0ad05dd12c3adc7a0b310d0c3647d881abe42832
Link:
https://www.unpac.me/results/2272fbba-4866-4ebc-9878-d026e71dce1d/
SH256 hash:
91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26
MD5 hash:
d6b2e107ac7ba9cb55fceb901651519b
SHA1 hash:
a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392
Link:
https://www.unpac.me/results/2272fbba-4866-4ebc-9878-d026e71dce1d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/176834/

Comments