MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76
SHA3-384 hash: 7e13e2c60c26ffc4ec98698e61ff95eb7e60f999df3838019552be3844dbc2a01e3ad96c6e5618c10347622fdf908fa5
SHA1 hash: 6491360291c65365333fad7ef0f6fa187913da72
MD5 hash: 91dc35fa23a889bd9ef1e703e0f9eed7
humanhash: comet-alanine-princess-sweet
File name:91dc35fa23a889bd9ef1e703e0f9eed7.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'386'496 bytes
First seen:2021-07-16 18:54:58 UTC
Last seen:2021-07-16 19:53:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:KSnKky46/Lixeuj7X/ST2l+Z7EXmlbs3KPC:KSvy46/kH/6qlc7y3W
Threatray 1'377 similar samples on MalwareBazaar
TLSH T16F55B53E6AA42A27B777D2604681C015F8BC91DB3A395DD742C7698C350E8027EE7F2D
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
91dc35fa23a889bd9ef1e703e0f9eed7.exe
Verdict:
Malicious activity
Analysis date:
2021-07-16 18:56:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/75008d87-22ed-4a1a-908d-bc6d920c66d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172254/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.14366.25877.30548.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/39580b54-7d9e-4de3-b273-0262ec9cc00e
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817666
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450077 Sample: vqZuFkopWm.exe Startdate: 16/07/2021 Architecture: WINDOWS Score: 100 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Raccoon Stealer 2->47 49 4 other signatures 2->49 8 vqZuFkopWm.exe 4 2->8         started        process3 file4 29 C:\Users\user\AppData\...\vqZuFkopWm.exe.log, ASCII 8->29 dropped 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->51 53 Adds a directory exclusion to Windows Defender 8->53 55 Injects a PE file into a foreign processes 8->55 12 vqZuFkopWm.exe 80 8->12         started        17 powershell.exe 23 8->17         started        19 vqZuFkopWm.exe 8->19         started        signatures5 process6 dnsIp7 39 telete.in 195.201.225.248, 443, 49721 HETZNER-ASDE Germany 12->39 41 34.89.184.90, 49722, 80 GOOGLEUS United States 12->41 31 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->31 dropped 33 C:\Users\user\AppData\...\ucrtbase.dll, PE32 12->33 dropped 35 C:\Users\user\AppData\...\softokn3.dll, PE32 12->35 dropped 37 56 other files (none is malicious) 12->37 dropped 57 Tries to steal Mail credentials (via file access) 12->57 59 Tries to harvest and steal browser information (history, passwords, etc) 12->59 21 cmd.exe 1 12->21         started        23 conhost.exe 17->23         started        file8 signatures9 process10 process11 25 conhost.exe 21->25         started        27 timeout.exe 1 21->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-16 13:50:35 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
4286fc8a5df90759f761ff7c238541af2504327c46855c81f68fb28563969975
RaccoonStealer
445d66bf5ba2df185287c3cb77ca459c45819d53d808a48981f3e8396f1c9658
RaccoonStealer
55dae3a9ea2e8108b1c8552f9605f2a8f8ce7116b055d96cf1c827989ac0efd5
RaccoonStealer
6c8131fc986f9477582f43530e0bdc660887285c83360c52e6b68876a57dc9b0
RaccoonStealer
c2789581cd578f5d0d40e0d774ace1ac3ce93793b20d12eca3136a83e1d67ce2
RaccoonStealer
c5315ad9f0f7467c15868d0400d8f8bd2100a130814aedd922af271d8687eda3
RaccoonStealer
fe65170a6f6cd5ba0df997262bca40350b650067db206bc83bfaf80da94bba9e
RaccoonStealer
+ 1'367 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware stealer
Link:
https://tria.ge/reports/210716-ejg7y3rmdx/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks installed software on the system
Maps connected drives based on registry
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
82a4065578bf324c5a382d4e43510bfe37dc2d4accaa25792aecea77c7387714
MD5 hash:
ecff0ff8f308ad9a7ab4e8d8c6632f1f
SHA1 hash:
b2149cd8ad0767e9ee467d85f7f5d97494ecb07a
Link:
https://www.unpac.me/results/889db3f1-0b9e-41df-a797-8aa8ed50c6f7/
SH256 hash:
8f55ef62272b7efdea4d02778914d1dd029fb6567455f0ce609194748753d13d
MD5 hash:
d89a1d3a4aed9e840e57db7eed920e11
SHA1 hash:
9b04ac969b75d4733ee18407c7a074b6e6193046
Link:
https://www.unpac.me/results/889db3f1-0b9e-41df-a797-8aa8ed50c6f7/
SH256 hash:
f4742ac9008bec3242660adb612489294c412b36ba0823ae63f29ad6561a27a4
MD5 hash:
b8129d6bbe1cb0a8070372bb50b16c51
SHA1 hash:
379d10eb5f849bd2db79010635c9d023384722e9
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/889db3f1-0b9e-41df-a797-8aa8ed50c6f7/
SH256 hash:
61149c1646d169ee23de2a9c52533c3d732c6b0abdbf468ff7712ff9ce649329
MD5 hash:
0d8d1eed39d0723a9b1d569cfb569d9c
SHA1 hash:
12f288566618d49f5c8b4aa499962efd3aad3a55
Link:
https://www.unpac.me/results/889db3f1-0b9e-41df-a797-8aa8ed50c6f7/
SH256 hash:
991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76
MD5 hash:
91dc35fa23a889bd9ef1e703e0f9eed7
SHA1 hash:
6491360291c65365333fad7ef0f6fa187913da72
Link:
https://www.unpac.me/results/889db3f1-0b9e-41df-a797-8aa8ed50c6f7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe 991cd470e36b51d3640eb6a1a40b6dbd54d2f82d6543fe38a46404bfc0a6bc76

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/172254/
  
URLhaus
https://urlhaus.abuse.ch/url/1433837/
  
Delivery method
Distributed via web download

Comments