MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c2978d525c68cceb114ea784ca6a6975dfee9ea7f2ac6aaebeb209a915524cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	9c2978d525c68cceb114ea784ca6a6975dfee9ea7f2ac6aaebeb209a915524cb
SHA3-384 hash:	88cec25bdfab07c5f1f666fee565b6506c31972e802c5891a8b3c86ac54db60f6c1fb0c205aaf548e60ce7927bb748d9
SHA1 hash:	0a982af57e5be5dcc06a4d680072a9ae52dcfaae
MD5 hash:	9f34d4f248f8f1ff7c8f683f5c97ee7d
humanhash:	river-vermont-network-monkey
File name:	9f34d4f248f8f1ff7c8f683f5c97ee7d.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	700'416 bytes
First seen:	2020-09-08 07:42:50 UTC
Last seen:	2020-09-08 09:03:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9bf298717846aef64e735ffc8bf64f55 (1 x RaccoonStealer)
ssdeep	12288:Ccx9JMY04hSv2yPViDKDE+A0hvkv2Fv6NOEVO+scoBTR1LTslRErSV1aAwHbJ+RJ:Ccx9Jt04S2y9/+mvkv2IN/FoRR1LTssu
TLSH	8FE40249AC908236E8A493F3C5F426ACA53E6D33134310D366BE72992F761D51A3F5CB
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/57824/

Detection(s):

SecuriteInfo.com.Trojan.Siggen10.13312.26765.16215.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

DNS request

Sending a custom TCP request

Creating a window

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Running batch commands

Launching a process

Stealing user critical data

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c2978d525c68cceb114ea784ca6a6975dfee9ea7f2ac6aaebeb209a915524cb/

Threat name:

Win32.Infostealer.Racealer

Status:

Malicious

First seen:

2020-09-07 20:08:24 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Result

Malware family:

raccoon

Score:

10/10

Tags:

ransomware discovery stealer family:raccoon spyware

Link:

https://tria.ge/reports/200908-8em2q953he/

Behaviour

Delays execution with timeout.exe

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks installed software on the system

JavaScript code in executable

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Raccoon

Raccoon log file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

QQpass

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9c2978d525c68cceb114ea784ca6a6975dfee9ea7f2ac6aaebeb209a915524cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_raccoon_a0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator