MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 13
| SHA256 hash: | a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9 |
|---|---|
| SHA3-384 hash: | 7cd636e08e8db7c8edd5630baf9930a0a7155d98ebbc6776061c30f54061985cf146bea0f2c970176567171813e64033 |
| SHA1 hash: | e73072a3b128e34805e7565d1cc90df085e89cdc |
| MD5 hash: | 639b8ee565307d8541ee1d9c86cf84d3 |
| humanhash: | victor-oranges-earth-sixteen |
| File name: | 639b8ee565307d8541ee1d9c86cf84d3.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 593'408 bytes |
| First seen: | 2021-11-04 15:50:28 UTC |
| Last seen: | 2021-11-04 17:37:58 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7220f2b8f04ec1b97c7c8d98e0adef7a (3 x Smoke Loader, 2 x RaccoonStealer, 1 x IcedID) |
| ssdeep | 12288:tKLeOwQ9Cy+Lze0z+YDEWNKfN7mxqfEGNegvP6fz:PO9W4MEPt4qfEGIgCz |
| TLSH | T1C3C4121372A1C431DBFB12345864E2661FB7B8225D7750CB2BAD7B264F34B908F2539A |
| File icon (PE): |  |
| dhash icon | 480c1c4c4f594b14 (172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey) |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
639b8ee565307d8541ee1d9c86cf84d3.exe
Verdict:
Malicious activity
Analysis date:
2021-11-04 18:56:27 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Detection:
raccoon
Threat name:
Win32.Ransomware.StopCrypt
Status:
Malicious
First seen:
2021-11-04 15:51:03 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:8dec62c1db2959619dca43e02fa46ad7bd606400 stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
e82323179c6aa25296935c2c0bb2cccc31cbdd6a1e6d5d07cca7cb39ba0e8ecd
MD5 hash:
12c5a03c855eef802d4acc9a88de4b13
SHA1 hash:
9b3277b88cd96f680cf247f8d7dc5bfcc08a0ccb
Detections:
win_raccoon_auto
Parent samples :
e0ddefa2d8101c3602f8186aa02c5b770e928a162bc3483dc85f605a4e0d03a3
a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
8abe4bc33112ce5bc9ce4ef8b33187c33a537cf540a63eb9562b4a0622f634aa
d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
8abe4bc33112ce5bc9ce4ef8b33187c33a537cf540a63eb9562b4a0622f634aa
d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SH256 hash:
2a250188ffe87fa64e93cccf3b197d89d6e5ab8ba8efea9a0149fc0a7f4d8fc3
MD5 hash:
b01767607a52909aec325b1a50853c3d
SHA1 hash:
87418f913d254ae822fb9a814b60db42e615cf60
SH256 hash:
931f53712545be28c7d66cdec08103fe13cad80aaa689e898e87e26195905dd0
MD5 hash:
67ba6bb553fdeaa6b7a783c9f642e642
SHA1 hash:
51d05d93daff50ba168c3a2af312dc6810ad83d9
SH256 hash:
a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
MD5 hash:
639b8ee565307d8541ee1d9c86cf84d3
SHA1 hash:
e73072a3b128e34805e7565d1cc90df085e89cdc
Malware family:
Raccoon v1.7.2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many email and collaboration clients. Observed in information stealers |
| Rule name: | MALWARE_Win_Raccoon |
|---|---|
| Author: | ditekSHen |
| Description: | Raccoon stealer payload |
| Rule name: | win_raccoon_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.raccoon. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.