MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb
SHA3-384 hash: 0e2b830647b9042d5786f2cdb0430d2ece82be99142f34473059599849e1112ba1c5913b53ce6e21254535561d75556d
SHA1 hash: e77bd208cad0c794ae49f83c88a46d810e36ada9
MD5 hash: 5f4dc886a572be6fd042ae952ca75e3b
humanhash: spaghetti-high-xray-neptune
File name:ae55d47a050f60be3b3cc00ea8575bc6
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:445'440 bytes
First seen:2020-11-17 15:28:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash df2b551a37fdd33960d531ea2b7b4df3 (4 x RaccoonStealer)
ssdeep 12288:adVhif2ybAlbf1MT8WPWBdGtROAV64qKs7KnJKjzaLQAe:QsYlbVWPydGtROAV64IKIzO
Threatray 217 similar samples on MalwareBazaar
TLSH 48940194BB72CD31C0A352713DB8E7628A277873977858C7EA4427686DB01E18EB7317
Reporter seifreed
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Glupteba-9622151-0
Create hunting rule

Win.Dropper.Glupteba-9622152-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:36:04 UTC
AV detection:
35 of 47 (74.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vt4yz4wwhpzoi62h4g6f5jeylya3v5xuhtb2ahpczjy5m3mha35q._file
Verdict:
malicious
Similar samples:
296a0bcb843e46c337e076b77cbc6395abccf232632c0ff67c5bbdde5ba5031e
RaccoonStealer
36ff62fbaac007872e3a67db3304ca430673458894c010780aab77141feb3875
RaccoonStealer
4b880328263a8d3318d26b36eaeeda4a2a87962b9b84637a5878a11d5a9df304
RaccoonStealer
501ebf8f394a5c9ce011f60d06fd27e948e40df690c1542903220f5800f19a2c
RaccoonStealer
5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e
RaccoonStealer
5ec6c811a8d46eb2195ff31ba92ba6bd09711c428047459ff180551ad184255d
RaccoonStealer
6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5
RaccoonStealer
854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422
RaccoonStealer
ca4f7d501b768375a9d3f839eb87a1c824f1c9dfdef9f8863332318523ba652a
RaccoonStealer
d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
RaccoonStealer
+ 207 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb
MD5 hash:
5f4dc886a572be6fd042ae952ca75e3b
SHA1 hash:
e77bd208cad0c794ae49f83c88a46d810e36ada9
Link:
https://www.unpac.me/results/54c5bd9b-1aa8-4a3e-bf81-2c56305a937c/
SH256 hash:
e65a98cc3f097bb413dddc734b1d96dfbd0344d9788685697e44007543d0eb61
MD5 hash:
16637848d7db10d94284716ad4ca3169
SHA1 hash:
aa17325c0f2f8e29ca4c0c1e0d729ee6e181fff5
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/54c5bd9b-1aa8-4a3e-bf81-2c56305a937c/
Parent samples :
d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
18037c34b9aafe45a8cd0743c637eac4abc50cfd6b14bd678bac6620ade45401
296a0bcb843e46c337e076b77cbc6395abccf232632c0ff67c5bbdde5ba5031e
acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_a0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments