MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8b46a2353a473d961ffbd25aa6eae088d5cada5a1ecc55d20c8e6f36d5fb1d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	a8b46a2353a473d961ffbd25aa6eae088d5cada5a1ecc55d20c8e6f36d5fb1d6
SHA3-384 hash:	7f95dcbc47093b33025eae8ee086049769df09c16ce4ac21f3eb0a74d1be879fa58f865d74e29cd062e8d9fff2e12535
SHA1 hash:	0ffebced562962284b89bee59c3b923e194a29b5
MD5 hash:	63b325e181e156eb84c8bc544669eebd
humanhash:	arizona-indigo-aspen-oscar
File name:	63b325e181e156eb84c8bc544669eebd.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	449'024 bytes
First seen:	2020-05-29 15:18:38 UTC
Last seen:	2020-05-29 15:57:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e854be910b0d091778c15574f55ff76f (2 x RaccoonStealer, 2 x ArkeiStealer)
ssdeep	6144:CvjjldTXnwVKnLp4EGMcXZ7fBKXr3t2OfDTpxqab5ztIALRzZ7:UdDnGEG74b9xq+2ALL
Threatray	204 similar samples on MalwareBazaar
TLSH	EFA412E2B3B0A465D05181347151EAB04EE87872AF527A132F8F2B0F7BF23D1D559B91
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://34.105.219.83/gate/log.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-29 15:05:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 31 (77.42%)

Threat level:

2/5

Verdict:

malicious

RaccoonStealer

2b54fb9596441cbdb7f2208b41a717adba83c5834a49c534f54d479131f750c1

RaccoonStealer

34d6b5b7b09f0d4c0228f41f8e262278b3d9b9708d37be7f18b05bf6a79061ad

RaccoonStealer

42a4a241b85a3c8bcd335504f822791859a2e74df645c70951996b35b53212d6

RaccoonStealer

70ec5843a563be04290314f543ed0369a822a71ee353008cda4a82346e341ff9

RaccoonStealer

8092f7adff425c2972f2716e2d31fedb1057c692eb8f0d4ca65d1a97537932a7

RaccoonStealer

8632fe4db48026aebe76829dc79cfc6f1e94670507a69e6d11a1b7abde3d5612

RaccoonStealer

cb96624fc5ed1dca5e1cbca928966a8e9e906817991314675e51fd98f83eb2a7

RaccoonStealer

ee01a3f2f668d1fc9a371b9234eb1352b5503430a461fa3c875a990aff72fde8

RaccoonStealer

ef3a1f525f383f8d5000a9f6fe4337f3c561ad41157d7cbb1bb2905aea18435c

RaccoonStealer

+ 194 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-jhn21l1blx/

Behaviour

Modifies system certificate store

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator