MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 3 File information Comments 1

SHA256 hash:	a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6
SHA3-384 hash:	f7b5f58fe28eeab7321462000612c74e85765d7ad23cb938e083c9387b8ef47c92e4c3df84b4a426e6fc28d50d7e7a5b
SHA1 hash:	2e9070a7c7e8e92b6a21170165628ebee2220a63
MD5 hash:	04d100e41d3293bf444651a39dc4e7e9
humanhash:	black-nevada-stairway-gee
File name:	04d100e41d3293bf444651a39dc4e7e9
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	527'360 bytes
First seen:	2021-12-07 19:53:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3e040a184666b793e8b84904205dc569 (1 x RedLineStealer, 1 x Amadey, 1 x RaccoonStealer)
ssdeep	12288:0S6vbpN+1aOJqJeHEZAhnuweNvWVkQWzGLOc:16dN+1aTekquWVczUOc
Threatray	4'425 similar samples on MalwareBazaar
TLSH	T146B4F11136C0C032C46124758925C3B1CA7FB87599269A8FBBD52BBC5F352E2EF3671A
File icon (PE):
dhash icon	d2b1e4d4ecb987f9 (38 x RedLineStealer, 18 x RaccoonStealer, 15 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

182

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

04d100e41d3293bf444651a39dc4e7e9

Verdict:

Malicious activity

Analysis date:

2021-12-07 19:56:24 UTC

Tags:

trojan stealer raccoon loader

Link:

https://app.any.run/tasks/36c0dfa1-cb94-4726-b4b3-a9a35d10a1c9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/212262/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.31726.23107.5280.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1257/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

azorult coinminer emotet glupteba greyware packed

Link:

https://www.filescan.io/uploads/61afbbde47ed217c0134eace/reports/a453934d-f24b-480e-bf17-1e80b193c182/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/30df66f0-1866-408a-b22b-f2f3b675f7fb

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/903411

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Self deletion via cmd delete

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-12-07 15:22:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ucdxzchth74pcdvzs3mzx7wpzd6olk2npdm6qzluyy6rhitvz7la._file

Verdict:

malicious

Label(s):

raccoon

RaccoonStealer

2f895a09ae635487eb6b767e6a95d90efa8d58a9d356229f5ee24f9963ab9e23

RaccoonStealer

4a47a042c53ecd2836f77477e003095403fe2b4194a48817fc420f8c224131a9

RaccoonStealer

56283f214f84bf23a55813990e2147767f71a61c6158ed1e5e9178527a6f90f1

RaccoonStealer

5c69bc614c6092798cecfa808358e97cda7c0ea53f30e1e124cb14b54cf9f1b0

RaccoonStealer

a9dc8bc2e80847e41c306c393801632e02efcd1a516cea1104912c4ccaefa8a6

RaccoonStealer

c6e1d668609e9c3d688d02bdab949ca4ed660f42b09bae1fc1c1ba9a04e1b98c

RaccoonStealer

+ 4'415 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:fd4f23250443a724a3d1548e6ab07c481dfc2814 stealer

Link:

https://tria.ge/reports/211207-ymjlgsffb2/

Behaviour

Raccoon

Unpacked files

SH256 hash:

f829ba13302ace3c84b0511f2c3b9c6afbb4ef3f55aacaef0203947f7b554e8b

MD5 hash:

dcc654266daa83a416b8fd08d72c1d83

SHA1 hash:

b0d3a6b00211d53ce951111f9ed0353c43f28bfd

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/49ef3240-7304-4a8f-888d-ab9513e6a2f9/

Parent samples :

8016cf2a984909cad748683e27ecef70a65c417317b55e8b4031d0aec1f10f06
a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6
4d6db76398fa37523b40e69ac3ae9dea6d04c3c51cce4c0a72e5d312d14e5017
ea1c45c03a1e539f0bddb675416be1f9b3d49b35ab27c2a8d0d27eaff2fc8341
37277505c9c29a553b922916789287d97ec515d25dc2cb499ded717347efac9c
dcf88ad773f7a6b5a16e382d74b99a05bdba5eb282568436b32a6457720216ec
eefc11d7652518188e5cec696e4e45f774acc45b4d158cba71eb5a8cfe392736
fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b

SH256 hash:

a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6

MD5 hash:

04d100e41d3293bf444651a39dc4e7e9

SHA1 hash:

2e9070a7c7e8e92b6a21170165628ebee2220a63

Link:

https://www.unpac.me/results/49ef3240-7304-4a8f-888d-ab9513e6a2f9/

Malware family:

Raccoon v1.7.2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/a0877c88f33f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Raccoon stealer payload

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

exe a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1863946/

Cape

https://www.capesandbox.com/analysis/212262/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-12-07 19:53:17 UTC

url : hxxp://file-coin-data-5.com/files/542_1638822952_3158.exe