MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6246092f49d5c01b9e6f5762e169c87fcae95adb22a68ecb7b3896cf373f661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 9

Intelligence 9 IOCs 1 YARA File information Comments

SHA256 hash:	b6246092f49d5c01b9e6f5762e169c87fcae95adb22a68ecb7b3896cf373f661
SHA3-384 hash:	faec2a7b450a3a33b2049a2e4bff9ce7f104bba1acd71e71da93576423e6adf87614bc5ae9627af2b0f87cbac22e4186
SHA1 hash:	33a121fec293e3a59ba27eca37b65cd2fa41741d
MD5 hash:	fcaac08ec995632f0e88cfba08c74c6b
humanhash:	glucose-zulu-lamp-winner
File name:	fcaac08ec995632f0e88cfba08c74c6b.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	218'624 bytes
First seen:	2021-08-30 02:31:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f047c2672b00c79ca70d8f2e6ab5c3f9 (17 x RaccoonStealer, 2 x Amadey, 2 x RedLineStealer)
ssdeep	6144:IC6QAshN8ICOTJHFXe1+VXfVRSP7EsI5/:ICRzhbC2Tv1Hc9c
Threatray	3'940 similar samples on MalwareBazaar
TLSH	T18724BDE5F2B0C172F0C615358849D6B056EBAD20FA209577368B575EFE35EC0922E2B3
dhash icon	fcfcd4f4d4dcd8c0 (34 x RaccoonStealer, 21 x RedLineStealer, 8 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://5.181.156.252/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://5.181.156.252/	https://threatfox.abuse.ch/ioc/201911/

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

fcaac08ec995632f0e88cfba08c74c6b.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-30 02:33:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4f8e6f78-aa30-42f6-a5c3-4268d44c424f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/183365/

Detection(s):

Win.Dropper.Fragtor-9889202-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %temp% directory

Creating a process from a recently created file

Sending an HTTP GET request

Sending a custom TCP request

Launching a process

Searching for the window

Sending a UDP request

Reading critical registry keys

Deleting a recently created file

Creating a file in the %AppData% subdirectories

Using the Windows Management Instrumentation requests

Setting browser functions hooks

Unauthorized injection to a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Malware family:

DarkComet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a816d36f-32c0-4c58-a0e0-bab6806eb030

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/841205

Signature

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b6246092f49d5c01b9e6f5762e169c87fcae95adb22a68ecb7b3896cf373f661/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-08-30 01:57:18 UTC

AV detection:

20 of 46 (43.48%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wysgbexutvoadopg6v3c4fu4q76k5fnnwivgr3fxwoewz43t6zqq._file

Verdict:

suspicious

RaccoonStealer

5c755d14199295a752594d0bb2a4c6bd7ede35ea7c078499fc7fff96451b2530

RaccoonStealer

60ab0131b6fa420a6a8039b60ac948db87033e9a8db69b16344e3d9222859556

RaccoonStealer

94eb2ab912a0fc0fb09538da52e4c36a50a1ea22cf6dfefe0b245f1687b8fe8f

RaccoonStealer

c55df5e9d0ea176321a29f8957c7a43188796ae0fc0ffe1ae94ad6092d30ba77

RaccoonStealer

c87fe4ff57a5464c0155bd1a8a924a2d77a79fdf87cba206e9ef5ac0d0f848cf

RaccoonStealer

d01b3ea3b793e2d269f00eadf0de7c751a2a2e08ad8373b8f025eff5d77dbb8a

RaccoonStealer

ecc608dedd0b55df6c75aeffcd51e11f3fd50d7422e4a1b26d4515a18419b9c4

RaccoonStealer

f4e1fc78ba0a65bde5687a67eb89e20166e062356b77227c9e0211060bd14dc8

RaccoonStealer

f74c97d626730018ba9a8dd5e6fb806bfcc42d15a8b20ef328cc5f0d6a052ccc

RaccoonStealer

+ 3'930 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:raccoon family:redline family:smokeloader botnet:d02c5d65069fc7ce1993e7c52edf0c9c4c195c81 botnet:fe582536ec580228180f270f7cb80a867860e010 botnet:zz backdoor discovery evasion infostealer spyware stealer themida trojan

Link:

https://tria.ge/reports/210830-7bzn5x5rxx/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

System policy modification

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks installed software on the system

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Windows security modification

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Nirsoft

Modifies Windows Defender Real-time Protection settings

Raccoon

RedLine

RedLine Payload

SmokeLoader

UAC bypass

Windows security bypass

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
185.167.97.37:30902