MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
SHA3-384 hash: 01bd21166e9a52a7e48fd21b81c41bbaa78d651812f7b138d74415c157c3183e3c0776379124d516382bd30fd6cb3010
SHA1 hash: 729b79644b48169917bb3edc128c54ade150d14e
MD5 hash: 877dc825c00e79e1150d80d8308b2839
humanhash: beryllium-cola-pizza-mississippi
File name:877dc825c00e79e1150d80d8308b2839.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'125'376 bytes
First seen:2021-01-02 08:16:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:0VqSO1YWG6795A5zwRfFIoSq46IKb3P7b:0VqSO77348VfSXQf7b
Threatray 575 similar samples on MalwareBazaar
TLSH 22357D1133F4AC53E47B0276233533C8DB7CA443B6D9E21E5AB625D4C23A9B6F694E42
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
877dc825c00e79e1150d80d8308b2839.exe
Verdict:
Malicious activity
Analysis date:
2021-01-02 08:19:57 UTC
Tags:
trojan stealer raccoon loader rat azorult remcos vidar
Link:
https://app.any.run/tasks/43d68916-bdde-497c-8094-6bf24e4db5d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/110292/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
DNS request
Sending a custom TCP request
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
Creating a process with a hidden window
Running batch commands
Launching a process
Unauthorized injection to a recently created process
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT Azorult Raccoon Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/572903
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 335513 Sample: Q2BZ01fmwK.exe Startdate: 02/01/2021 Architecture: WINDOWS Score: 100 100 agentpurple.ac.ug 2->100 102 agentpapple.ac.ug 2->102 104 4 other IPs or domains 2->104 130 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->130 132 Found malware configuration 2->132 134 Malicious sample detected (through community Yara rule) 2->134 136 13 other signatures 2->136 10 Q2BZ01fmwK.exe 15 5 2->10         started        signatures3 process4 dnsIp5 124 rebelfgighter.ac.ug 194.61.53.10, 49721, 49727, 49728 M247GB Russian Federation 10->124 86 C:\Users\user\AppData\Local\...\aghkdfgh.exe, PE32 10->86 dropped 88 C:\Users\user\AppData\...\Q2BZ01fmwK.exe.log, ASCII 10->88 dropped 154 Injects a PE file into a foreign processes 10->154 15 aghkdfgh.exe 14 5 10->15         started        19 Q2BZ01fmwK.exe 87 10->19         started        file6 signatures7 process8 dnsIp9 90 C:\Users\user\AppData\Local\...\oghkdfgh.exe, PE32 15->90 dropped 126 Injects a PE file into a foreign processes 15->126 22 aghkdfgh.exe 15->22         started        27 oghkdfgh.exe 3 15->27         started        29 aghkdfgh.exe 15->29         started        106 telete.in 195.201.225.248, 443, 49725 HETZNER-ASDE Germany 19->106 108 trashbininspector.fun 104.18.59.219, 443, 49726 CLOUDFLARENETUS United States 19->108 110 192.168.2.1 unknown unknown 19->110 92 C:\Users\user\AppData\...\y0zaHkks6u.exe, PE32 19->92 dropped 94 C:\Users\user\AppData\...\Ji8U6UQXR6.exe, PE32 19->94 dropped 96 C:\Users\user\AppData\...\7Fa3D1GIii.exe, PE32 19->96 dropped 98 60 other files (1 malicious) 19->98 dropped 128 Tries to steal Mail credentials (via file access) 19->128 31 Ji8U6UQXR6.exe 19->31         started        33 3zMBGvkFYy.exe 19->33         started        35 7Fa3D1GIii.exe 19->35         started        37 2 other processes 19->37 file10 signatures11 process12 dnsIp13 112 rebelfgighter.ac.ug 22->112 62 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 22->62 dropped 64 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 22->64 dropped 66 C:\Users\user\AppData\Local\Temp\ds1.exe, PE32 22->66 dropped 74 49 other files (none is malicious) 22->74 dropped 138 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->138 140 Tries to steal Instant Messenger accounts or passwords 22->140 142 Tries to steal Mail credentials (via file access) 22->142 148 4 other signatures 22->148 144 Injects a PE file into a foreign processes 27->144 39 oghkdfgh.exe 27->39         started        44 oghkdfgh.exe 27->44         started        56 2 other processes 27->56 68 C:\Users\user\AppData\Local\...\tmp1116.tmp, XML 31->68 dropped 70 C:\Users\user\AppData\...\IAapkDPBpUFkb.exe, PE32 31->70 dropped 46 Ji8U6UQXR6.exe 31->46         started        48 schtasks.exe 31->48         started        50 Ji8U6UQXR6.exe 31->50         started        114 cdn.discordapp.com 162.159.135.233 CLOUDFLARENETUS United States 33->114 116 discord.com 162.159.136.232, 443, 49733 CLOUDFLARENETUS United States 33->116 72 C:\Users\user\AppData\Local\...\Wyprwekn.exe, PE32 33->72 dropped 146 Creates a thread in another existing process (thread injection) 33->146 52 WerFault.exe 33->52         started        54 7Fa3D1GIii.exe 35->54         started        58 2 other processes 37->58 file14 signatures15 process16 dnsIp17 118 malscxa.ac.ug 39->118 76 C:\ProgramData\vcruntime140.dll, PE32 39->76 dropped 78 C:\ProgramData\sqlite3.dll, PE32 39->78 dropped 80 C:\ProgramData\softokn3.dll, PE32 39->80 dropped 84 4 other files (none is malicious) 39->84 dropped 150 Tries to harvest and steal browser information (history, passwords, etc) 39->150 152 Tries to steal Crypto Currency Wallets 39->152 120 agentpurple.ac.ug 46->120 122 agentttt.ac.ug 79.134.225.40 FINK-TELECOM-SERVICESCH Switzerland 46->122 60 conhost.exe 48->60         started        82 C:\Windows\Temp\um51g5xz.exe, PE32 54->82 dropped file18 signatures19 process20
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-02 08:17:04 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w622qky4tm6c77xnzrl3fpxtl5q4p2j6ylk246cpmz7e3dktiaeq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
azorult
Create hunting rule
Similar samples:
17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
4be1e912f4b6f65dd938f0a6fa1f1d9b8d4c20fc25ac3c3189e10013c29e4dea
RaccoonStealer
60152e8f49b376387ea78e05be97894b52c0dc862a9906248b12a441e840ee2d
RaccoonStealer
6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
RaccoonStealer
ac8a0b325adca9cc88fc6ee32c912024adfe5228024712e1c757183c51260d16
RaccoonStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
RaccoonStealer
c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
RaccoonStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
RaccoonStealer
d8f37e199f10881b2045823553fd64f3f52ec616e24f2235a47dae7c435a3c72
RaccoonStealer
+ 565 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:modiloader family:oski family:raccoon discovery evasion infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/210102-5gcnsbr7de/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Adds Run key to start application
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Windows security modification
Loads dropped DLL
Executes dropped EXE
Async RAT payload
ServiceHost packer
AsyncRat
Contains code to disable Windows Defender
ModiLoader, DBatLoader
Modifies Windows Defender Real-time Protection settings
Raccoon
Azorult
Oski
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
Unpacked files
SH256 hash:
b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
MD5 hash:
877dc825c00e79e1150d80d8308b2839
SHA1 hash:
729b79644b48169917bb3edc128c54ade150d14e
Link:
https://www.unpac.me/results/43f04f06-7681-4e42-8c4d-802c64783dfb/
SH256 hash:
64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86
MD5 hash:
88c0ec8398978fa2e4240f02765086ad
SHA1 hash:
5a5c4935b2d70e890c89ad9332365f4f4aa86f3c
Link:
https://www.unpac.me/results/43f04f06-7681-4e42-8c4d-802c64783dfb/
SH256 hash:
48b0b1fc5bd4d8d6e0ab48ac1c2833bd05d956fb8a8227a2a885c2867c0a5515
MD5 hash:
b112d171f46a5925da34a075652e3fcf
SHA1 hash:
f3c42f5d2c43effb7682ebd40383b93e5028152a
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/43f04f06-7681-4e42-8c4d-802c64783dfb/
SH256 hash:
632d3774de737fc2791abdd358177c2ebe42382cc2f5de7f58b17f6d7d48ee3b
MD5 hash:
1c5480f5de487d87a7a4ad73e09411fe
SHA1 hash:
ffea21995b665bcf2d11d2aac235a4e462028c94
Link:
https://www.unpac.me/results/43f04f06-7681-4e42-8c4d-802c64783dfb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/906880/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/422736/
  
URLhaus
https://urlhaus.abuse.ch/url/879389/
Cape
Cape
https://www.capesandbox.com/analysis/110292/
  
URLhaus
https://urlhaus.abuse.ch/url/790808/
  
URLhaus
https://urlhaus.abuse.ch/url/399076/
  
URLhaus
https://urlhaus.abuse.ch/url/446430/

Comments