MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4
SHA3-384 hash: 494a932ae31718fc97d9b0317be7328f321b310958d2272f47993cc6ea3d1b7e485242642d379406afe305926344e8b4
SHA1 hash: b3a35ee716082024a67c054fa4a1d1e468ac0672
MD5 hash: 8673a9d723844b1d3504e1cedd4da3d8
humanhash: bluebird-michigan-red-stream
File name:8673a9d723844b1d3504e1cedd4da3d8
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:4'145'304 bytes
First seen:2022-02-01 02:25:27 UTC
Last seen:2022-02-01 04:03:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep 49152:cRnODNb6uKFmqlKhnlvjvujIM8cJhBMorc0+AE0MV0H7jNBX3yInVKRWS7cNa3Up:BDNuulqYruIM7JPj+AE6H7Rt3dzS4M6
Threatray 2'907 similar samples on MalwareBazaar
TLSH T15116331B67F1F1DEC382FC34427467A473BE30A61254EEEF5589079E43703299A6E90A
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8673a9d723844b1d3504e1cedd4da3d8
Verdict:
Suspicious activity
Analysis date:
2022-02-01 02:36:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9d661e11-405d-4ddd-b960-3b6c56d0a624

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/228986/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
DNS request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61f89a3f18d1bfdde4e4b3f5/reports/593dc88b-3f20-48a7-92aa-c25e030c4d95/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac8a44e4-1293-4d00-a9b5-e68c36dbe303
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931348
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 563824 Sample: AOm1BTn5l8 Startdate: 01/02/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 5 other signatures 2->54 8 AOm1BTn5l8.exe 2->8         started        process3 signatures4 56 Writes to foreign memory regions 8->56 58 Allocates memory in foreign processes 8->58 60 Injects a PE file into a foreign processes 8->60 11 AppLaunch.exe 80 8->11         started        16 WerFault.exe 23 9 8->16         started        18 WerFault.exe 2 9 8->18         started        20 WerFault.exe 9 8->20         started        process5 dnsIp6 42 91.219.236.139, 80 SERVERASTRA-ASHU Hungary 11->42 44 194.180.174.147, 80 MIVOCLOUDMD unknown 11->44 46 3 other IPs or domains 11->46 28 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 11->28 dropped 30 C:\Users\user\AppData\LocalLow\...\nss3.dll, PE32 11->30 dropped 32 C:\Users\user\AppData\...\mozglue.dll, PE32 11->32 dropped 40 56 other files (none is malicious) 11->40 dropped 62 Tries to steal Mail credentials (via file / registry access) 11->62 64 Tries to harvest and steal browser information (history, passwords, etc) 11->64 66 DLL side loading technique detected 11->66 22 cmd.exe 1 11->22         started        34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->38 dropped file7 signatures8 process9 process10 24 conhost.exe 22->24         started        26 timeout.exe 1 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4/
Threat name:
Win32.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 02:26:19 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ss3piquyen3ucjszwim577ei63ixdmceyzsyhtackm254l4onksa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0dc9020d1da0f60fb0ea2b10ee9e6930f67e5d3bc5859ba390973e5165d86b7a
RaccoonStealer
15ec70046b6bcf402d46edfc374574ada52bb672a956d38b9c04677873c59543
RaccoonStealer
1bbee1727c791557b1119c32a93c58964414a1cce3dcc0601f92bb628e033a59
RaccoonStealer
8f0ce948ee3b5f284eed19d5065de393931e6979eac0d177464d55e2e470c3e7
RaccoonStealer
ba1d27e1521b29f5fabc05094b177131f356588ce26b2e5336910df2bd1cc919
RaccoonStealer
c25d1fe88e1b97a9b07941683641db28863d24e4c422a9cb4033db3cf641a9ae
RaccoonStealer
+ 2'897 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
3e0c2abaa4797124408462f3e1a9564d46701ce1108017625468a4b62876d660
MD5 hash:
3baf430d926f0269a1396bf64c3fcd4f
SHA1 hash:
bd4d5ab6fae51256820ec4ab81afafeb20f8e63b
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/b223b59e-c34c-4f58-b899-bcd5bcb7efc6/
SH256 hash:
94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4
MD5 hash:
8673a9d723844b1d3504e1cedd4da3d8
SHA1 hash:
b3a35ee716082024a67c054fa4a1d1e468ac0672
Link:
https://www.unpac.me/results/b223b59e-c34c-4f58-b899-bcd5bcb7efc6/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/94b6f4429823/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 94b6f442982377412659b219dffc88f6d171b044c66583cc025335de2f8e6aa4

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2020130/
Cape
Cape
https://www.capesandbox.com/analysis/228986/

Comments


Avatar
zbet commented on 2022-02-01 02:25:30 UTC

url : hxxp://coin-coin-file-9.com/files/3418_1643567607_6870.exe