MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 5 File information Comments

SHA256 hash:	9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55
SHA3-384 hash:	0d6c0cc5133b3d01a38e839cf44de56c88839f38e269dce240b8dd23594f5673431969c9f2aa37e543a583486d2229bb
SHA1 hash:	75be194ab3eeed3f275c4002b9ee48e8dfadff31
MD5 hash:	e3bab115577cea97b7cebe9f1394c064
humanhash:	lemon-hotel-oregon-solar
File name:	e3bab115577cea97b7cebe9f1394c064.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	437'760 bytes
First seen:	2021-03-13 08:46:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cc30f6e59bfe4c4aa3e155047b05a7b3 (2 x RaccoonStealer)
ssdeep	12288:CUC8zzhY6+KLjbaWV1swtiTjv/qV/K6f+N2I+Dhrnq7ndW:7Y6+Wr9cTb/0Crh+tqg
Threatray	437 similar samples on MalwareBazaar
TLSH	6094011038E2C877D1511A750829C6B00A7BFCB59F2146CB7B927B6A3F352E1AB35367
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
https://mynameischarliebrown.top/

Intelligence

File Origin

# of uploads :

# of downloads :

212

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e3bab115577cea97b7cebe9f1394c064.exe

Verdict:

Malicious activity

Analysis date:

2021-03-13 08:47:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/264e4bc3-6ca4-4a4f-a3a0-ddec6c7da341

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/124091/

Detection(s):

SecuriteInfo.com.Malware.PDB-11.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Delayed reading of the file

Sending a TCP request to an infection source

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/638554

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55/

Threat name:

Win32.Trojan.Guloader

Status:

Malicious

First seen:

2021-03-13 08:47:08 UTC

AV detection:

23 of 47 (48.94%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=txjpbaqnlr5wa4zfow5sjsc7otocweuowfklve55tbc5cnqtb5kq._file

Verdict:

malicious

RaccoonStealer

1c1cac311f126dd8a0a2b969af40fccbe62c6569fc9c1aea7ee7054f48f1d033

RaccoonStealer

3a8f6b8aa7bfb84430ba0623be44b4efb47eda325003c6a37c59fa939120b76f

RaccoonStealer

499e3672259c28f6bd35d790c2ec4f52835cfcd46c8ddf279df4b02d4d07d7e5

RaccoonStealer

706a3b4438e7b883d8c3cd66ffabfbb3e3495b3b7c6f9b48adf7a5c8cdd0c3c1

RaccoonStealer

78f5967d8bd5d31343632e8558b9315d9d44d009c923b9c41d417943906f2849

RaccoonStealer

854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422

RaccoonStealer

cc77c899048dadecb42238532dff0969e362bfe01cf5507f1462d71ce58360ba

RaccoonStealer

d0b4ea79bfa3aad2d6343a52811b837c45229253cda7abb26b4df2107ab52d58

RaccoonStealer

e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5

RaccoonStealer

+ 427 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:afefd33a49c7cbd55d417545269920f24c85aa37 discovery spyware stealer

Link:

https://tria.ge/reports/210313-2fe3frdb7n/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Raccoon

Unpacked files

SH256 hash:

0a00415f8e43a51ceccaa6599bdb216148fe0cbc895b2acfa137e819cda36681

MD5 hash:

48ff9d7470c13b9de99968bd76f5db1e

SHA1 hash:

5cbe772066d7c7f0b512f58267c1250907b0849e

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/f8cb32de-b5b3-4d6b-b104-1b55f4eced32/

Parent samples :

6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
10d9ab7f8640e19022c6222361b655356f7edbe4bf51708f0b94be96bc167085
9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55
8fd17cdc025ce08669dae201714f915a869554bd8339fe494dc58b29ec4c8110
2d07abc10994157494bad3b2a9d5181c040fd8e230a168d5b9d9aaf19390ab5d
b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d
9f9db94621c74bf0f8e8d8a4fc2b1319e11f3d87cb90ba8b20c2945a53a6b874

SH256 hash:

9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55

MD5 hash:

e3bab115577cea97b7cebe9f1394c064

SHA1 hash:

75be194ab3eeed3f275c4002b9ee48e8dfadff31

Link:

https://www.unpac.me/results/f8cb32de-b5b3-4d6b-b104-1b55f4eced32/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9dd2f0820d5c7b60732575bb24c85f74dc2b128eb154ba93bd9845d136130f55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator