MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe
SHA3-384 hash: 0ed30ad979538935aa39da6a4ef40e138281523089bcbd13039a1617e1f4064fff0b4f2e21bc6e3d2e765f0cbb73194f
SHA1 hash: ce963b526baa5f30cee3eddccf09a9abd9293bc7
MD5 hash: 36227924a8359c39384a9306fd9edd04
humanhash: oscar-music-sierra-lake
File name:36227924a8359c39384a9306fd9edd04.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:476'672 bytes
First seen:2021-10-28 15:55:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c2a1052396d8d35dd7ffdeb3af100bc8 (3 x RaccoonStealer, 1 x Tofsee)
ssdeep 6144:UHeuuD8oD4+qpoQ+mJcqHNId4dn7i9b7YzTwpBI7K/uzbgwu6L7ITsq:cuD8oM+qpouyMGmd2OXT7gunnn7
Threatray 3'860 similar samples on MalwareBazaar
TLSH T196A401F076ADC071D1A32830CC66CB914EFABD61D960818777741B5E1BB2ACC5AE631E
File icon (PE):PE icon
dhash icon fcfc94d4d4dcd8c0 (2 x ArkeiStealer, 2 x Tofsee, 2 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200991/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.35416.29150.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a5a9824-3946-4fd5-af10-0d0e9820ef84
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/878743
Signature
Antivirus detection for URL or domain
Contains functionality to steal Internet Explorer form passwords
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 03:23:27 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uw6qjehl7cclgff2albvkdxkjccz7nnvmsv637mvzdvin35n7d7a._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
3d6dc41241fe3784d89b8dadddc0297750ebb0602ebed8e1736230d2ae15cfb5
RaccoonStealer
678f03e1574817fdf555ebe8701534034315d008addfb0dd7aac8fd35d17e855
RaccoonStealer
7c21b1b5f71348d4cf42b5ea75b24ea009e86dfae75f8c65d0b62f069863e130
RaccoonStealer
8795a656616316101fcc0ccdc8c6a014dbbcb143882dd39c1e4d4dc61c6293b6
RaccoonStealer
92903659aa911b14052c620cd548e51b485ad4ae013fd32caa5f2a7f8f81e3b7
RaccoonStealer
afa506dea7e88d3aa2ff4c2f58a21a91cf5d6ae5a00dea2cf482832d1613e37b
RaccoonStealer
d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a
RaccoonStealer
+ 3'850 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211028-tdcpcsgfcm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
c50103b45414bbf89e3e94f78276e6d6aff1a2e63b9e1ae1c2e385688b18214e
MD5 hash:
d190f77efbd8f25bd8911fbf4571653b
SHA1 hash:
2e92b5879eef75ec7b2d280820c75dd4854bbc85
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/dee286f5-db29-472a-ad5d-ae0658a8746b/
Parent samples :
0abca757a21c853f04a42d9198e1d165cba434e5602609a0783e3e04131bd29e
3d6dc41241fe3784d89b8dadddc0297750ebb0602ebed8e1736230d2ae15cfb5
e207d845291c3dfb68393d2e2b610f1b8f59a91cd01df89f8eb848b4c9c62100
a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe
SH256 hash:
a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe
MD5 hash:
36227924a8359c39384a9306fd9edd04
SHA1 hash:
ce963b526baa5f30cee3eddccf09a9abd9293bc7
Link:
https://www.unpac.me/results/dee286f5-db29-472a-ad5d-ae0658a8746b/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a5bd0490ebf8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe a5bd0490ebf884b314ba02c3550eea48859fb5b564abedfd95c8ea86efadf8fe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200991/

Comments