MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a04f87d376498c78629d44f3c05aa91b69c38c168b827eeb56d77fc14187ad99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a04f87d376498c78629d44f3c05aa91b69c38c168b827eeb56d77fc14187ad99
SHA3-384 hash: 945b235db2cdee7f68076b9c5ad62d89c48976f1ab050a7308391c79c12a60212c0fd81a2d7c3509eae566fae0295012
SHA1 hash: 7e9e9eec8cf84291703cc69752fc13ca19408bac
MD5 hash: 2adf8ab189b9a8cdfdd7b368e6fa29d0
humanhash: kentucky-hydrogen-paris-sodium
File name:2adf8ab189b9a8cdfdd7b368e6fa29d0.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:467'968 bytes
First seen:2021-08-26 09:41:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c8d9df578fc452582af8996e539153c (17 x RaccoonStealer, 3 x Glupteba, 1 x Smoke Loader)
ssdeep 6144:Ispmo8/C+CTpIxedGI6gxXEAYHbcEmMMtnyj8FpCMwUmZC8HwhZU9sI5/:IDC+8pIxkPDxEAYwEmTtnywxVmXec
Threatray 3'074 similar samples on MalwareBazaar
TLSH T1A9A40148BE70C17AF8C205755C3AD360697B79E3DA7082573B809FBE3A252C0561DADB
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.163.47.239/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.47.239/ https://threatfox.abuse.ch/ioc/195888/

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2adf8ab189b9a8cdfdd7b368e6fa29d0.exe
Verdict:
Malicious activity
Analysis date:
2021-08-26 09:43:24 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/c52a9e2e-70b9-43da-b63a-e33a0ad762dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182557/
Detection(s):
Win.Packed.Generic-9888553-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
DNS request
Connection attempt to an infection source
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
Running batch commands
Launching a process
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32df2522-867f-441e-8eec-107e78542495
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/839623
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 472052 Sample: NY2nNtJVOD.exe Startdate: 26/08/2021 Architecture: WINDOWS Score: 88 46 Multi AV Scanner detection for domain / URL 2->46 48 Found malware configuration 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 3 other signatures 2->52 6 NY2nNtJVOD.exe 80 2->6         started        process3 dnsIp4 42 telete.in 195.201.225.248, 443, 49721, 49738 HETZNER-ASDE Germany 6->42 44 185.163.47.239, 49739, 49742, 49743 MIVOCLOUDMD Moldova Republic of 6->44 20 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 6->20 dropped 22 C:\Users\user\AppData\...\vcruntime140.dll, PE32 6->22 dropped 24 C:\Users\user\AppData\...\ucrtbase.dll, PE32 6->24 dropped 26 56 other files (none is malicious) 6->26 dropped 54 Tries to steal Mail credentials (via file access) 6->54 56 Tries to harvest and steal browser information (history, passwords, etc) 6->56 11 WerFault.exe 9 6->11         started        14 WerFault.exe 9 6->14         started        16 WerFault.exe 9 6->16         started        18 7 other processes 6->18 file5 signatures6 process7 file8 28 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 11->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 14->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->38 dropped 40 3 other malicious files 18->40 dropped
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a04f87d376498c78629d44f3c05aa91b69c38c168b827eeb56d77fc14187ad99/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 09:42:07 UTC
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubhypu3wjgghqyu5itz4awvjdnu4hdawrobh522w2574cqmhvwmq._file
Verdict:
malicious
Similar samples:
14e4824be0683d1089694045fb18bfef2da645ab2c4c8b07158894e9d9ec2a1b
RaccoonStealer
16165ccc830fd684b7ee45b9edc104b22f8a516a0e82c5a6655b464c794b4022
RaccoonStealer
704ea934e75448ed30e38117fe27b81b6dfdeb0f2a498bd0ae5474ec3d5014d7
RaccoonStealer
a6f0b3c49ac430d8d1e46dc1936c43ca12f90d39327ab157cb04844f9e04d8f2
RaccoonStealer
adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a
RaccoonStealer
b0ccf88d4b5ae968794c601fd99c0af9c61d617693cdb9de743ca03a199c1ea2
RaccoonStealer
dca102c7e82eadf4ed9610081714bf04462e486ae00921d52acc850374aa4141
RaccoonStealer
f5e61fcc4300b16d273ba8e0a957ad8cc89f757d5329409cfed0dea6ae64c322
RaccoonStealer
+ 3'064 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:73b5ba9e979dfff074f4d2205f6f4e53934ad14c discovery spyware stealer
Link:
https://tria.ge/reports/210826-emgj5mvy5a/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
e672b753d7ae88aab3e1e43e6a38e78ebbdb86ad8715164612e5c3aa15e2e6eb
MD5 hash:
1838cc518bfa1d5ec50fe60e084ef032
SHA1 hash:
6e534ab63a1883089c1a90fa8c624e0744e6d164
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/6de8b303-a479-4c6c-a957-ace892d31bb3/
SH256 hash:
a04f87d376498c78629d44f3c05aa91b69c38c168b827eeb56d77fc14187ad99
MD5 hash:
2adf8ab189b9a8cdfdd7b368e6fa29d0
SHA1 hash:
7e9e9eec8cf84291703cc69752fc13ca19408bac
Link:
https://www.unpac.me/results/6de8b303-a479-4c6c-a957-ace892d31bb3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a04f87d37649/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a04f87d376498c78629d44f3c05aa91b69c38c168b827eeb56d77fc14187ad99

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/182557/

Comments