MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
SHA3-384 hash: b70023dae5a07815f9cbd90a8128d2008141ae59c2577b827fc814c65465ee2ce0270283f9d9c2fd6dc4ba2b60cd5617
SHA1 hash: 80e7b787928df6c7599956c08039d108b96c3e93
MD5 hash: eb3db5499d6268d825cb9290596230a1
humanhash: october-single-nuts-lake
File name:eb3db5499d6268d825cb9290596230a1.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:348'672 bytes
First seen:2021-10-29 05:58:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e7e707cb5a6cd20211e77d5d46383cea (16 x RaccoonStealer, 3 x Smoke Loader, 2 x RedLineStealer)
ssdeep 6144:KbU5N94BCje52ASpvaZv1xZ8gn7FBH0TpUF:KY5NA6i2vaZv14gnL0FU
Threatray 2'173 similar samples on MalwareBazaar
TLSH T143748C10A7A1C035F5F212F85AB6936DA93F7AB16B7490CF12D526EE4A746E0EC31307
File icon (PE):PE icon
dhash icon badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://194.180.174.181/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.180.174.181/ https://threatfox.abuse.ch/ioc/239344/

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.79361.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80c3f84f-a8c6-4e5c-808f-d031759b229e
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879045
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 511507 Sample: rouraiQ4P3.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 Antivirus detection for URL or domain 2->58 60 5 other signatures 2->60 9 rouraiQ4P3.exe 2->9         started        12 rfisbrg 2->12         started        14 rfisbrg 2->14         started        process3 signatures4 62 Contains functionality to inject code into remote processes 9->62 64 Injects a PE file into a foreign processes 9->64 16 rouraiQ4P3.exe 9->16         started        19 rfisbrg 12->19         started        66 Multi AV Scanner detection for dropped file 14->66 68 Machine Learning detection for dropped file 14->68 21 rfisbrg 14->21         started        process5 signatures6 46 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 16->46 48 Maps a DLL or memory area into another process 16->48 50 Checks if the current machine is a virtual machine (disk enumeration) 16->50 23 explorer.exe 4 16->23 injected 52 Creates a thread in another existing process (thread injection) 19->52 process7 dnsIp8 40 xacokuo8.top 185.185.69.21, 49744, 49745, 49746 SPRINTHOSTRU Russian Federation 23->40 42 216.128.137.31, 80 AS-CHOOPAUS United States 23->42 44 2 other IPs or domains 23->44 34 C:\Users\user\AppData\Roaming\rfisbrg, PE32 23->34 dropped 36 C:\Users\user\AppData\Local\Temp\5C11.exe, PE32 23->36 dropped 38 C:\Users\user\...\rfisbrg:Zone.Identifier, ASCII 23->38 dropped 70 System process connects to network (likely due to code injection or exploit) 23->70 72 Benign windows process drops PE files 23->72 74 Deletes itself after installation 23->74 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->76 28 5C11.exe 23->28         started        file9 signatures10 process11 signatures12 78 Machine Learning detection for dropped file 28->78 31 5C11.exe 28->31         started        process13 signatures14 80 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 31->80 82 Maps a DLL or memory area into another process 31->82 84 Checks if the current machine is a virtual machine (disk enumeration) 31->84 86 Creates a thread in another existing process (thread injection) 31->86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-29 05:19:14 UTC
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ungyzndjpwj7aayomupr4h3g2z6ecgz2pnuiglezqgwriwswbpjq._file
Verdict:
malicious
Similar samples:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
RaccoonStealer
29669b199ce94a9ee97f8955480b8e8f5b0ed8b38824f4316f094668a71e0b2c
RaccoonStealer
7f7b289e8bfd8e547f28478238c98b7ad31c7601e6033b5c1c79afc924b40a6c
RaccoonStealer
98886fc4886cba3974e82ab69176ba4545ea10f6d8b61350d6088eaae9aba519
RaccoonStealer
a499e99f2ec3aef0ed06f1d8c2c5b5752bdf1575cba0b2230ea49f810f2db7d4
RaccoonStealer
c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b
RaccoonStealer
+ 2'163 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:raccoon family:redline family:smokeloader family:vidar botnet:21321313 botnet:517 botnet:68e2d75238f7c69859792d206401b6bde2b2515c botnet:706 botnet:754 botnet:9b47742e621d3b0f1b0b79db6ed26e2c33328c05 botnet:safeinstaller botnet:z0rm1on backdoor collection discovery infostealer persistence ransomware spyware stealer suricata trojan
Link:
https://tria.ge/reports/211029-gpranshean/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
Detected Djvu ransomware
Djvu Ransomware
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
http://xacokuo8.top/
http://hajezey1.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
http://193.56.146.214/
https://193.56.146.214/
https://mas.to/@lilocc
93.115.20.139:28978
185.183.32.161:80
185.215.113.94:15564
https://mas.to/@xeroxxx
http://rlrz.org/lancer
Unpacked files
SH256 hash:
7504bf3fa2768578ecf547d7ad5ee704bb32a345726f4d6007e4905db82c873c
MD5 hash:
67832761c9fb6dcaa2caaa433aeef1e9
SHA1 hash:
1f40855c5efb001c8dff2d10e10b8c68d573d68f
Link:
https://www.unpac.me/results/a88cceec-8017-4646-83b4-d481f6f689dc/
SH256 hash:
a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
MD5 hash:
eb3db5499d6268d825cb9290596230a1
SHA1 hash:
80e7b787928df6c7599956c08039d108b96c3e93
Link:
https://www.unpac.me/results/a88cceec-8017-4646-83b4-d481f6f689dc/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a34d8cb4697d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1719493/
  
Delivery method
Distributed via web download

Comments