MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0
SHA3-384 hash: dc6ca36c0d12357d70ae2e824af310edd483204de0f44127537d7fa45145ac60ac3243688a169f18bf2b35d92c2e29fe
SHA1 hash: 1c57f5242e42f536470ad82b56881f2fd6347987
MD5 hash: a875620b019fdacc8a7ee2ce19d82ad9
humanhash: don-tennis-pip-winner
File name:a875620b019fdacc8a7ee2ce19d82ad9.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:3'476'908 bytes
First seen:2021-08-16 23:50:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:J7ISOiGF7zsEtAU0o5g7rWCAfptaIjBlIgbBM4ocH7uTWRU:JDGFXsHMgmfvlB1F6cHqTd
Threatray 368 similar samples on MalwareBazaar
TLSH T158F533B26324F063C6AE087D526753300D5F6722F31E299FA6962CC9275A684D23D7F3
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
159.69.178.36:37556

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
159.69.178.36:37556 https://threatfox.abuse.ch/ioc/190411/
45.66.8.61:58416 https://threatfox.abuse.ch/ioc/190418/

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
61046b966467661046_setup_v18.2.9.zip
Verdict:
Malicious activity
Analysis date:
2021-07-30 21:21:20 UTC
Tags:
evasion loader trojan
Link:
https://app.any.run/tasks/27deb1bc-273b-464e-9c45-545e21cf3a40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179788/
Detection(s):
Win.Malware.Generic-9852703-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Barys-9859550-0
Create hunting rule

Win.Trojan.Jaik-9862229-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Trojanx-9873669-0
Create hunting rule

Win.Packed.SmokeLoader-9873637-1
Create hunting rule

Win.Malware.Malwarex-9882661-0
Create hunting rule

Win.Dropper.Malwarex-9882944-0
Create hunting rule

Win.Malware.Generickdz-9883917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for the window
Moving a recently created file
Running batch commands
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Deleting a recently created file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9bb5625c-9880-4610-8d6c-d881fb40c066
Result
Threat name:
RedLine Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833976
Signature
.NET source code contains very large strings
Antivirus detection for dropped file
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected RedLine Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 466402 Sample: 7XvFqLynVI.exe Startdate: 17/08/2021 Architecture: WINDOWS Score: 100 59 185.233.185.134 YURTEH-ASUA Russian Federation 2->59 61 37.0.11.8 WKD-ASIE Netherlands 2->61 63 22 other IPs or domains 2->63 73 Multi AV Scanner detection for domain / URL 2->73 75 Antivirus detection for dropped file 2->75 77 Multi AV Scanner detection for dropped file 2->77 79 10 other signatures 2->79 10 7XvFqLynVI.exe 10 2->10         started        signatures3 process4 file5 45 C:\Users\user\AppData\...\setup_installer.exe, PE32 10->45 dropped 13 setup_installer.exe 18 10->13         started        process6 file7 47 C:\Users\user\AppData\...\setup_install.exe, PE32 13->47 dropped 49 C:\Users\user\AppData\Local\...\sahiba_9.txt, PE32 13->49 dropped 51 C:\Users\user\AppData\Local\...\sahiba_8.txt, PE32 13->51 dropped 53 13 other files (7 malicious) 13->53 dropped 16 setup_install.exe 1 13->16         started        process8 dnsIp9 55 172.67.170.195 CLOUDFLARENETUS United States 16->55 57 127.0.0.1 unknown unknown 16->57 37 C:\Users\user\AppData\...\sahiba_3.exe (copy), PE32 16->37 dropped 39 C:\Users\user\AppData\...\sahiba_2.exe (copy), PE32 16->39 dropped 41 C:\Users\user\...\sahiba_10.exe (copy), PE32 16->41 dropped 43 7 other files (1 malicious) 16->43 dropped 69 Detected unpacking (changes PE section rights) 16->69 71 Machine Learning detection for dropped file 16->71 21 cmd.exe 1 16->21         started        23 cmd.exe 1 16->23         started        25 cmd.exe 1 16->25         started        27 2 other processes 16->27 file10 signatures11 process12 process13 29 sahiba_3.exe 91 21->29         started        33 sahiba_2.exe 23->33         started        35 sahiba_1.exe 2 25->35         started        dnsIp14 65 116.202.183.50 HETZNER-ASDE Germany 29->65 67 74.114.154.22 AUTOMATTICUS Canada 29->67 81 Detected unpacking (changes PE section rights) 29->81 83 Detected unpacking (overwrites its own PE header) 29->83 85 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 29->85 87 Tries to harvest and steal browser information (history, passwords, etc) 29->87 89 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 33->89 91 Maps a DLL or memory area into another process 33->91 93 Checks if the current machine is a virtual machine (disk enumeration) 33->93 signatures15
Detection:
glupteba
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-07-31 18:55:00 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=to3x7m5umk33kjuu6azgxa5u6d2hs2jebyuwckonepndwl7jr6ya._file
Verdict:
unknown
Similar samples:
261b33850dd1404b22acfd5fe7e46806dce68f710f9b21b7ec00a264804e2137
RaccoonStealer
2aafe51ed875d14265117e71337eaf72d2d22f8055ad43356062efbde0eb6f4a
RaccoonStealer
4927f0b88f61a54fb9c8d14081cd5a80c6c6f358e8431af76fda5a5366d81aa8
RaccoonStealer
5d10fa7657f41f17d508c1dbb3f63b5b2ad6deea2f47e747b118345a56ab6cdc
RaccoonStealer
9e74b137b73150bea9b3ef6b987d3af1b3c445163c8ea469e6608d3ebc6062d9
RaccoonStealer
aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e
RaccoonStealer
+ 358 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:vidar botnet:706 botnet:aniold botnet:ls4 aspackv2 backdoor discovery evasion infostealer spyware stealer suricata trojan upx
Link:
https://tria.ge/reports/210816-fvg4f1cev6/
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
Raccoon
Raccoon Stealer Payload
RedLine
RedLine Payload
SmokeLoader
Vidar
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
https://xeronxikxxx.tumblr.com/
liezaphare.xyz:80
ighaisexel.xyz:80
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Unpacked files
SH256 hash:
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
MD5 hash:
cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 hash:
b968c57a14ddada4128356f6e39fb66c6d864d3f
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
55361941ab12c7edd987c706d25423d868f756fab1028d99eeffacdabf3da4ca
MD5 hash:
4de4b7bc0a92902422c4204fcfa58150
SHA1 hash:
587e0299ea32cc836281998941daa60f471e3480
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
MD5 hash:
7165e9d7456520d1f1644aa26da7c423
SHA1 hash:
177f9116229a021e24f80c4059999c4c52f9e830
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
a44daa993632ffb1fb4a1faf7b290318d07bb242a081230578e67fcba57615ba
MD5 hash:
668960d5d4afb0024cb967cf6b495673
SHA1 hash:
14ca4cdbd4a07d0fac894c0f3f01c9ab5d2d50d0
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
269d2ae2661789f8929d934a7f7e44b6d6fa2e2fc3799fd53b44988aed906b1f
SH256 hash:
ff5b7e9a2d5af436c13951d0746015237e3b12f4d4dc845a92b4e430c098e224
MD5 hash:
8ecc287212bb08f80f80c4ec1a7c6c4c
SHA1 hash:
59d08bda2e494600ed25fd608582b25261ec13b0
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
Parent samples :
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
65341b1f7f4018e163e564b546012d5bfa41a70c9b9926a0b48781ae4e3f9ec3
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
edd2a0334bfcf63a8c9b9d3a148fd6ad7f76a757ea56589b0670cb72d7dce6ff
MD5 hash:
ad6992e6f028f1f9cd8714ad4cf5313e
SHA1 hash:
f837082d106727a30ff849ed3838da6cfdd4b29c
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
6e6f66db46614369636de1d2f660451ea08b56f6f5edc79b43e11c556ca3e19c
MD5 hash:
a032e5940de619a26975c56959b34afa
SHA1 hash:
a97cc129d2940a82cddbc6ba7888f511728194af
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
MD5 hash:
270dd1da0ab7f38cdff6fab84562ec7a
SHA1 hash:
cf7be169ee4415085baeb4aeaa60932ac5abf4ac
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
4df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
MD5 hash:
3011f2257b899aa8196e02447383a46b
SHA1 hash:
cb90ff25622aa5e5e20e257f6c6cb3ce58bd6940
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
Parent samples :
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
08ff3e3f7c7148ed5d559de3c2a5fc6c3668f88e54c5472f68529f2983411856
MD5 hash:
81f26d1ce16c7ea00bc62e341e64625c
SHA1 hash:
b666e80f667fc80ecd4fa077e37d4baeec1a17a8
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
d0812c78e146d7774b25061dbdabae004fefc503ea363b441fa691add1eef26b
MD5 hash:
255aac71617edb0cc31709ef30fbee0a
SHA1 hash:
98ef84fd1e1cc4ff60a52bab85d00db7093a8f01
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
5e48fa65285cf78077e7a4838db4988d42052bc3b2f62b81f3817794d1332b03
MD5 hash:
a31b7fd74f673785c4f0101409def34b
SHA1 hash:
4d3c9403c5659c1a7a31dc7b8612b2886ed6da6c
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
MD5 hash:
eb73f48eaf544bf7e035a58f95f73394
SHA1 hash:
251f0d09f14452538ecfa0924a4618c3c16887e3
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 hash:
c0d18a829910babf695b4fdaea21a047
SHA1 hash:
236a19746fe1a1063ebe077c8a0553566f92ef0f
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
ff7121a3cc24f5b299055f77d50872ad2d3c9858e5485153baf63e96bf330393
MD5 hash:
b088a54c89b354aad1090ec41477af12
SHA1 hash:
2072f4e5f91dfc041cfd1dcb902fd84c4ea58f29
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
c6257b7fac0a4b71b81cda1d51ad80fdb7aa00d5ea60baec8521f6a63151e5ac
MD5 hash:
b0f872cac1498ea4a91dc2090de9700a
SHA1 hash:
7c8ff111fce940b3736673f104d9967cbd0883bf
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
SH256 hash:
9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0
MD5 hash:
a875620b019fdacc8a7ee2ce19d82ad9
SHA1 hash:
1c57f5242e42f536470ad82b56881f2fd6347987
Link:
https://www.unpac.me/results/2735e2d7-c651-4b52-adab-4cbe36d9fb5b/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9bb77fb3b462/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9bb77fb3b462b7b52694f0326b83b4f0f47969240e296129cd23da3b2fe98fb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179788/

Comments