MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0
SHA3-384 hash: c1f5b3d279a13888b33e89c3bb5f22ed15331f41c72084e24b2fb193707a301f5145bbb7438baaf73abcfdf5c6fbd127
SHA1 hash: 1d07813751d678475c8115b4e25e5816d6d98d9d
MD5 hash: a1cfa4a945b12ff461ec8bc898b40aa0
humanhash: mars-london-cold-hydrogen
File name:a1cfa4a945b12ff461ec8bc898b40aa0.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:8'134'130 bytes
First seen:2021-09-20 02:45:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 196608:y4YemJyHeHLhob3LvoFGEESrnm8iBvlQHhq6CrnHtkL/5eCh:yny+WzLvoIEJZiBvlYCrCLheCh
Threatray 562 similar samples on MalwareBazaar
TLSH T137863324296D2CE5FA0BAB3BF4794584DDB9A43513D9EBC107791F38FB5408AE443E22
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://74.119.192.122/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://74.119.192.122/ https://threatfox.abuse.ch/ioc/223651/

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189172/
Detection(s):
Win.Dropper.Pswtool-9857535-0
Create hunting rule

Win.Packed.Barys-9859263-0
Create hunting rule

Win.Malware.Barys-9859499-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Malware family:
Socelars
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9e832d2a-7908-4180-8fd0-c1f8348f9578
Result
Threat name:
RedLine SmokeLoader Socelars
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/852646
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates HTML files with .exe extension (expired dropper behavior)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 485074 Sample: setup_x86_x64_install.exe Startdate: 17/09/2021 Architecture: WINDOWS Score: 100 62 88.99.66.31 HETZNER-ASDE Germany 2->62 64 104.21.14.200 CLOUDFLARENETUS United States 2->64 66 4 other IPs or domains 2->66 82 Antivirus detection for URL or domain 2->82 84 Antivirus detection for dropped file 2->84 86 Multi AV Scanner detection for dropped file 2->86 88 14 other signatures 2->88 10 setup_x86_x64_install.exe 10 2->10         started        signatures3 process4 file5 40 C:\Users\user\AppData\...\setup_installer.exe, PE32 10->40 dropped 13 setup_installer.exe 21 10->13         started        process6 file7 42 C:\Users\user\AppData\...\setup_install.exe, PE32 13->42 dropped 44 C:\Users\user\AppData\...\Fri10f52dcf4a.exe, PE32 13->44 dropped 46 C:\Users\user\AppData\...\Fri10e9c92174.exe, PE32 13->46 dropped 48 16 other files (8 malicious) 13->48 dropped 16 setup_install.exe 1 13->16         started        process8 dnsIp9 58 172.67.142.91 CLOUDFLARENETUS United States 16->58 60 127.0.0.1 unknown unknown 16->60 80 Adds a directory exclusion to Windows Defender 16->80 20 cmd.exe 1 16->20         started        22 cmd.exe 1 16->22         started        24 cmd.exe 1 16->24         started        26 3 other processes 16->26 signatures10 process11 signatures12 29 Fri104264d4077e0.exe 4 68 20->29         started        34 Fri10e9c92174.exe 3 22->34         started        36 Fri10d3c74b7e073d.exe 1 24->36         started        90 Adds a directory exclusion to Windows Defender 26->90 38 powershell.exe 26 26->38         started        process13 dnsIp14 68 37.0.10.214 WKD-ASIE Netherlands 29->68 70 37.0.10.244 WKD-ASIE Netherlands 29->70 78 11 other IPs or domains 29->78 50 C:\Users\...\zq8UEzWyOov3yVYeR8MAeouv.exe, PE32+ 29->50 dropped 52 C:\Users\...\xYWvQ1hWRQQJExrUJLvkV1HV.exe, PE32 29->52 dropped 54 C:\Users\...\wxPtt2ZEmrZepa49XxUlquId.exe, PE32 29->54 dropped 56 35 other files (32 malicious) 29->56 dropped 92 Drops PE files to the document folder of the user 29->92 94 Creates HTML files with .exe extension (expired dropper behavior) 29->94 96 Tries to harvest and steal browser information (history, passwords, etc) 29->96 98 Disable Windows Defender real time protection (registry) 29->98 100 Query firmware table information (likely to detect VMs) 34->100 102 Tries to detect sandboxes and other dynamic analysis tools (window names) 34->102 104 Hides threads from debuggers 34->104 106 Tries to detect sandboxes / dynamic malware analysis system (registry check) 34->106 72 208.95.112.1 TUT-ASUS United States 36->72 74 45.136.151.102 ENZUINC-US Latvia 36->74 76 192.168.2.1 unknown unknown 36->76 108 Machine Learning detection for dropped file 36->108 110 Tries to detect virtualization through RDTSC time measurements 36->110 file15 signatures16
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0/
Threat name:
Win32.Downloader.Zenlod
Create hunting rule
Status:
Malicious
First seen:
2021-09-18 01:12:31 UTC
AV detection:
32 of 45 (71.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wrnovl5q4gqn5vtekj45b6bi4v2vbifvsarxhwpdazt5bq6l3lqa._file
Verdict:
unknown
Similar samples:
2cbf19a8dbaba0978d5a52447c9cac23918c4394e751e0cde159d6e8b65c408f
RaccoonStealer
4f4c2c9bdfef8a8cfbe2c8f84bf12cc86f26f59d54c277dab39f4c5e92948708
RaccoonStealer
5967f1aef118ddfcd1d14d5cf3f29a62a845052c9ed9ce91587c0015b1047c58
RaccoonStealer
80594c4ce01c53c6bcc472e88329cc23f51b0d3276c8f5b3a686033f8d2d452e
RaccoonStealer
941478d129063e71885f97791339a49c58c72991ccc8309734f12ef60aee5530
RaccoonStealer
bf0c11eae9de14227141901dffc7bdbd1ecb9b0a2cb1e675f7d36ce5eff0679e
RaccoonStealer
c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19
RaccoonStealer
f38f738f52674e3f4689cdb299e82d40a6446ccec24abd4cac244fe64cdc07ed
RaccoonStealer
f5f477d945634e37e1abca7c1390e03a7535005c9ff071a191f4d24274bdf075
RaccoonStealer
f92cfeb06515f18113a950d5bd569a23cdd85514ef509ccff6c5a4e9a08ca4c7
RaccoonStealer
+ 552 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:socelars family:vidar botnet:199qwe botnet:ani botnet:pab123 aspackv2 backdoor discovery evasion infostealer stealer themida trojan vmprotect
Link:
https://tria.ge/reports/210920-c9dsvscfg3/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Loads dropped DLL
Modifies file permissions
Themida packer
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Vidar
Malware Config
C2 Extraction:
45.14.49.169:22411
45.142.215.47:27643
185.215.113.104:18754
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Unpacked files
SH256 hash:
588626e5e2d07844f2b59eb51dce36bc8f6c123ceff817813bf4c31aebdd1bf5
MD5 hash:
8ecea1e237042ecd057de60e97b89e7a
SHA1 hash:
fb1a226b3c324c49d88ac6a6726f90641dc93977
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
0fd897b1e74f50e47526f974bf4906ecbe4a331b1ae4e2ec309fbee57a032586
MD5 hash:
4c3423a6e5e3337c71c551358f1334c1
SHA1 hash:
e3f59c4781ab6b19adb9eb85054a060b34c3df73
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
c02d2c9ae0b587f9b7631c443ce5a7d6d409c0a5d09ff6b389ca1330d44a1149
MD5 hash:
a91a81780273bb279790c1fbb6fb3105
SHA1 hash:
4bedae163300009aac8afa2c2b42ea6c184ca9dd
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
1afe83c3ba3bec5a93023e3c4b5340fd6f1b9cc4263c048221aff240750fb0a3
MD5 hash:
07602200548e73b949bebfd58133bfa8
SHA1 hash:
f7f537237cdac1bcea5c231857d37ca121ebab1f
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
f1787e5f33a30369195faaec0f0d81e18024fbe6da2f88a7a6990246f29d6d32
MD5 hash:
9f44d0d077f594752cc9660176846f98
SHA1 hash:
d152b652af4f79606d962322c53edbe7ddaae239
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
21b40e67adbac5b3e134cff537226f9e9ca5edd227a6be4597c5a48942a02283
MD5 hash:
552f2403bef6ff62e584d05a7a56eaf7
SHA1 hash:
c8523d2ba01b45e71ecf389cc24f1167ff93289f
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
da6e2470414935131c3a094758be78605ec1c1ba8ddc755d175ac73763cc307a
MD5 hash:
03cd7541a32149209ecec14115466bc3
SHA1 hash:
bff67b407cffb1d3f3afbbcee15046e968204af3
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
3274005fc4effba965ad331a099fb01ef34218f7612512635cd178244ab3761c
MD5 hash:
ea7ae694330b551e0d282f1634737f1a
SHA1 hash:
b28eabbe05e93baee7b654b6c12b5665fed44db8
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
0774e456af11fef527b61be8244024179740afd1b47307af367c0cc665e4a4cb
MD5 hash:
802e054f9035a041f8655076418765cc
SHA1 hash:
a3fbc09059295d4c3206b88f69ba3f557993c84a
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
76d284ec46660dca41c2b65aeb0add85c1436e5445e418df7ffafb2e457ef5d5
MD5 hash:
499b03f7152d9b395b5cc858ae3d5dd1
SHA1 hash:
9e4b8204a103471995d935bf32b940bfa3658049
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
9246a374c90fad12aaa3d5565c37df50bc3b6be37dd1a5788c227177703cfff3
MD5 hash:
21a3d424103af8a5112e4f39249f0b2a
SHA1 hash:
9587f9c78dbcac0bb836a4a21e61bd4e4d323cb9
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
8109ce4f6e937530731141c0be96e6b0ffb703daf4595ffea44556101ce5f03b
MD5 hash:
76c54755f14a21d92a85a717620452bf
SHA1 hash:
93a635b272b67b7c326ec333d23029698b4ffeb3
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
52701e2808de643baf6789222e4c2422cca70733222cd2e6d0b9f36a4f6eeabc
MD5 hash:
71a718d5f6f6a69ce1e844fec2a06f53
SHA1 hash:
5e3d339c99bb37e485eeadb71c9aa72a8e06fdab
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
3dcf1c5cb1b65d5d59edcc8c7d5b521ee27f26c996cefcf6f9ff4d9e05adcbe4
MD5 hash:
0ab03929e4442a16dba9c5a82feadd96
SHA1 hash:
3f191602955d9254ace5a88d91cab1bdf622c324
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
147c89071ccbb5790a9c81acdbe5975f96dc130866e7dda2f299dc7e8528205f
MD5 hash:
d1f3309c8b6896b1bfc93153baedb2ee
SHA1 hash:
3522c85609d8e6926e982daf604d90050b3c9da4
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
79249202eec021c6d6c3f5732a55c635f501725ac61e20d27cce48adf109fdfd
MD5 hash:
75b02651b3d608848c0104c7e1adc038
SHA1 hash:
6337f93871c3480d06bfa76ccd3495b754781eed
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
38046382500f1739883d2c53639ffbc5756843da7574fe3e6820724f522958e2
MD5 hash:
33600475b2cc5445df2d3809c3798311
SHA1 hash:
3cb60432de30b82e87b8b607e0180a7843128b5a
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
Parent samples :
aa79b859945459fd6d1363c35e68c9d2674a78f1fdee02b8ddfab9a8fa011b48
e96f083ab18199d6a745b0fb3a8852b863b94a906664570198c8277abe4195c6
a412840c44db8bca039ce13176d7d6b9be9b2cbd1ef81eb85cd2f0c9180f6511
bf9714f60c2b4b43cc0383b3155d9c737271916032051df041fed54d34f7c765
2c3382e9eb5bbbfe86a88f9d8a75557c3f60707af088ce5f1283ee7a33cc3fbf
a3f0b643265e9895b3291658516ce2b34eb06d585bd8ea77fd61fda26917e0d9
5c97c35e6537283493bbfcd8fa178157898e6d266a36eadb9ab23bbcef613efc
SH256 hash:
36d5afdcb0fa8d512656aa5a59f34018885bb1b9dd5cc0780766552809cfb45f
MD5 hash:
4f9c74430d72b9500a0d99cc28fc7a7e
SHA1 hash:
a67cf6a62a6cabec501aa2f14e97c48b71dbd97c
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
d1417ebebd174d666a6abc9481d65b39fc2d88559f7fd92ebb7e2f1ae93787db
MD5 hash:
70220a3ce6ffd34101b3770342505f2c
SHA1 hash:
b55c421634d8eeaec5c6193f34c04625d21a9ae9
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
5f463952815ce4f763e9f4b3b72ed70ad82f74a69a271fc2b1588055c3fec4cc
MD5 hash:
21775ff041e7277d87aa8fdf1e09da6c
SHA1 hash:
6dd1d6716cb93adef6c9b39490a79e77fd5396c9
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
15b73b968b83db1316340255ba12bc07fb07f55da51fde25d9a1b39a481872a7
MD5 hash:
f67865adbd902c19104c0b061096167a
SHA1 hash:
5390107c1d9150274edae4ccff0f1d52fb5f8e1b
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
fc6f8466556df07a5499c1475b086ef06a6ad238afac78f6dfc73b877d77ba85
MD5 hash:
f52846b36cb0fffbcf729ed204dceef6
SHA1 hash:
342be3eecf78675e4fa88138ee9aab01c002fc44
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
e95c37d99d05b42af5193ba3f31e582cc5aed79db31e70d59ad7667ddeaf719a
MD5 hash:
314ce3497e2b2294b8cad7a3dcb5d92d
SHA1 hash:
0f21450b721f6102cce6ed370ea3cbe80a2a7866
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
7b174066dcdb563d4c54a72b57041d3c5a3c73e46ef4c8f01d861c4227c299e8
MD5 hash:
0c4acd9a18717fea045903f5ba132e1b
SHA1 hash:
ddd3577b03472a92a629008522af4c968fb9411a
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
3b9edead4322a1a96db763a5fa6fcf17f2ea850b24caed3555268d25f7b3fcd1
MD5 hash:
8d823ad5f6d391a4011277fb32fd692a
SHA1 hash:
7f9061bdb23d552912181cc6036ad49534e57786
Detections:
win_socelars_auto
Create hunting rule
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
7c408cfee01e47ec80bb4aadd5bf9784243d6f3bfac0fc1d7068dda7201293da
MD5 hash:
ac4dcfa0b21a5d5bb3482436e7dceb19
SHA1 hash:
cb4bc477565607c40cccaf5b9a65c8f58f69d3a2
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
SH256 hash:
b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0
MD5 hash:
a1cfa4a945b12ff461ec8bc898b40aa0
SHA1 hash:
1d07813751d678475c8115b4e25e5816d6d98d9d
Link:
https://www.unpac.me/results/fd85256d-995a-40ae-af9d-05207a315bf3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189172/

Comments