MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4
SHA3-384 hash: 8ebb98a2c5f3fec3bd80fc7ee676b2e2bc355019e393b0c32d33a207163a63fc0829d50f4659ccc25c858d8ed7e2adde
SHA1 hash: 144839def677c03619aa837a652cedd8ec432576
MD5 hash: 2246f89b65a4c0d9f57acbf396722168
humanhash: october-football-harry-maine
File name:2246f89b65a4c0d9f57acbf396722168.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:175'104 bytes
First seen:2021-10-28 23:47:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18875662b19ade4ddd6bba43f9abb4a3 (12 x RaccoonStealer, 3 x RedLineStealer, 1 x DanaBot)
ssdeep 3072:RCTK8mM2ET6N68dnZrIVzwf4WrxpzbgqrukVggjcGkNIVqI:cTOM2EsNk9o4uzbgwuA7ITsq
Threatray 5'210 similar samples on MalwareBazaar
TLSH T11004AEF072ECC472D063F53189338AA1562ABC61DA7899473374223E1E75ECC4AE536E
File icon (PE):PE icon
dhash icon fcfcf4d4d4d4d8c8 (12 x RedLineStealer, 9 x RaccoonStealer, 2 x Smoke Loader)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://194.180.174.181/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.180.174.181/ https://threatfox.abuse.ch/ioc/239344/

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Fragtor.35416.2589.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/01eba640-d6c4-48fa-8273-3b1f6349698d
Result
Threat name:
Raccoon RedLine SmokeLoader Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878941
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
DLL reload attack detected
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Renames NTDLL to bypass HIPS
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Yara detected Vidar
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 511375 Sample: t63ouMqJ8f.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 74 xacokuo8.top 2->74 76 telegalive.top 2->76 78 4 other IPs or domains 2->78 108 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->108 110 Multi AV Scanner detection for domain / URL 2->110 112 Found malware configuration 2->112 114 15 other signatures 2->114 10 t63ouMqJ8f.exe 2->10         started        13 hcisitd 2->13         started        15 svisitd 2->15         started        signatures3 process4 file5 124 Contains functionality to inject code into remote processes 10->124 126 Injects a PE file into a foreign processes 10->126 18 t63ouMqJ8f.exe 10->18         started        21 hcisitd 13->21         started        72 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 15->72 dropped signatures6 process7 signatures8 100 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 18->100 102 Maps a DLL or memory area into another process 18->102 104 Checks if the current machine is a virtual machine (disk enumeration) 18->104 106 Creates a thread in another existing process (thread injection) 18->106 23 explorer.exe 12 18->23 injected process9 dnsIp10 80 216.128.137.31, 80 AS-CHOOPAUS United States 23->80 82 znpst.top 138.36.3.134, 49875, 80 TEXNETSERVICOSDECOMUNICACAOEMINFORMATICALTDBR Brazil 23->82 84 9 other IPs or domains 23->84 64 C:\Users\user\AppData\Roaming\hcisitd, PE32 23->64 dropped 66 C:\Users\user\AppData\Local\Temp\B7F8.exe, PE32 23->66 dropped 68 C:\Users\user\AppData\Local\Temp\A814.exe, PE32 23->68 dropped 70 15 other files (7 malicious) 23->70 dropped 116 System process connects to network (likely due to code injection or exploit) 23->116 118 Benign windows process drops PE files 23->118 120 Deletes itself after installation 23->120 122 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->122 28 4199.exe 1 23->28         started        31 658E.exe 23->31         started        35 2862.exe 15 3 23->35         started        37 5 other processes 23->37 file11 signatures12 process13 dnsIp14 128 DLL reload attack detected 28->128 130 Detected unpacking (changes PE section rights) 28->130 148 5 other signatures 28->148 86 github.com 31->86 88 45.95.235.77, 49851, 49873, 80 YURTEH-ASUA Russian Federation 31->88 96 2 other IPs or domains 31->96 50 C:\ProgramData\upd.exe, PE32 31->50 dropped 52 C:\Users\user\AppData\Local\...\new[1].exe, PE32 31->52 dropped 54 C:\ProgramData\sqlite3.dll, PE32 31->54 dropped 132 Query firmware table information (likely to detect VMs) 31->132 134 Tries to detect sandboxes and other dynamic analysis tools (window names) 31->134 150 2 other signatures 31->150 90 cdn.discordapp.com 162.159.129.233, 443, 49808, 49811 CLOUDFLARENETUS United States 35->90 136 Writes to foreign memory regions 35->136 152 3 other signatures 35->152 39 EdmGen.exe 35->39         started        41 AppLaunch.exe 35->41         started        43 CasPol.exe 35->43         started        92 194.180.174.181, 49872, 49893, 80 MIVOCLOUDMD unknown 37->92 94 93.115.20.139, 28978, 49868 MVPShttpswwwmvpsnetEU Romania 37->94 98 2 other IPs or domains 37->98 56 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 37->56 dropped 58 C:\Users\user\AppData\...\vcruntime140.dll, PE32 37->58 dropped 60 C:\Users\user\AppData\...\ucrtbase.dll, PE32 37->60 dropped 62 30 other files (none is malicious) 37->62 dropped 138 Tries to steal Mail credentials (via file access) 37->138 140 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 37->140 142 Tries to harvest and steal browser information (history, passwords, etc) 37->142 144 Tries to steal Crypto Currency Wallets 37->144 45 B7F8.exe 37->45         started        48 5810.exe 37->48         started        file15 146 System process connects to network (likely due to code injection or exploit) 86->146 signatures16 process17 signatures18 154 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 45->154 156 Maps a DLL or memory area into another process 45->156 158 Checks if the current machine is a virtual machine (disk enumeration) 45->158 160 Creates a thread in another existing process (thread injection) 45->160
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 20:56:04 UTC
AV detection:
21 of 44 (47.73%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wraggi4on3qblyiileachevt7hjfvq4uqtv3yvqywvrlwnkopl2a._file
Verdict:
malicious
Similar samples:
6d7596a48c5e95b3f42a58b09348c4293f92a0a6738c5850856bf1a5b323a6a8
RaccoonStealer
6f54181807e2995147e132e7bf87ed669966b4f68a49b29fdaf4467864aa946a
RaccoonStealer
8b9e05937557c312981409e1107aa75b580f170138d0a7abf3cfaa93dd9113aa
RaccoonStealer
be032b655d9a935fbca887adfc5e478085b7d64c96720c57da870c2d463ed881
RaccoonStealer
c37feba7ad29a50f566e779edd2c5514edcbd6e87909ca4d8e6d1f9727362d94
RaccoonStealer
d2b72372d1f6ff858237a0804714acfb2afa47ad2c2530a749ba738d2e0cf416
RaccoonStealer
ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
RaccoonStealer
fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b
RaccoonStealer
+ 5'200 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:djvu family:raccoon family:redline family:smokeloader family:vidar botnet:21321313 botnet:517 botnet:68e2d75238f7c69859792d206401b6bde2b2515c botnet:706 botnet:754 botnet:9b47742e621d3b0f1b0b79db6ed26e2c33328c05 botnet:safeinstaller botnet:z0rm1on backdoor collection discovery evasion infostealer persistence ransomware spyware stealer themida trojan
Link:
https://tria.ge/reports/211028-3te9vscch7/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Arkei
Detected Djvu ransomware
Djvu Ransomware
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Vidar
Malware Config
C2 Extraction:
http://xacokuo8.top/
http://hajezey1.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
http://193.56.146.214/
https://193.56.146.214/
93.115.20.139:28978
185.183.32.161:80
https://mas.to/@lilocc
185.215.113.94:15564
https://mas.to/@xeroxxx
http://rlrz.org/lancer
Unpacked files
SH256 hash:
7504bf3fa2768578ecf547d7ad5ee704bb32a345726f4d6007e4905db82c873c
MD5 hash:
67832761c9fb6dcaa2caaa433aeef1e9
SHA1 hash:
1f40855c5efb001c8dff2d10e10b8c68d573d68f
Link:
https://www.unpac.me/results/bdbb1d06-4632-46b2-a7cd-734dbe334e7d/
SH256 hash:
b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4
MD5 hash:
2246f89b65a4c0d9f57acbf396722168
SHA1 hash:
144839def677c03619aa837a652cedd8ec432576
Link:
https://www.unpac.me/results/bdbb1d06-4632-46b2-a7cd-734dbe334e7d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe b44063238e6ee015e10859002392b3f9d25ac39484ebbc5618b562bb354e7af4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1719493/
  
Delivery method
Distributed via web download

Comments