MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d
SHA3-384 hash: 84364b1cca91edd36871d80cd8f636817f4189680ca45bb2735e1feefd821d8185b62a89410c5a4b3c093204c716035d
SHA1 hash: 6f411a9410c47183e57adf98d5c521059ff1c16b
MD5 hash: 062f484c0443481867f8ef46e84aaf64
humanhash: tango-oranges-jig-iowa
File name:062f484c0443481867f8ef46e84aaf64.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:146'432 bytes
First seen:2021-08-29 07:00:57 UTC
Last seen:2021-08-29 08:20:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0336658842541b9e17744ccc2800922a (13 x RaccoonStealer, 2 x CoinMiner, 2 x RedLineStealer)
ssdeep 1536:LXcAUlFHKbp1Q9BFrU67hhLa9VA3CXsUqTG5KU0Ya9zcC0sjk5/Npj6T61mD:iLgMhLmVAysbC5KgY6sI5/DuT61m
Threatray 4'030 similar samples on MalwareBazaar
TLSH T1E6E3BE0136B1C973C1D6157084A9EAA12A6FBC31AE758A8B3758073F3E762C1963F357
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://84.246.85.16/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://84.246.85.16/ https://threatfox.abuse.ch/ioc/201706/

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2021-08-29 01:14:17 UTC
Tags:
loader trojan rat redline stealer evasion opendir vidar danabot
Link:
https://app.any.run/tasks/991e1eaa-b9db-48b7-85ce-e2177d509cb4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183202/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.1293.15320.3248.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Launching a process
Searching for the window
Reading critical registry keys
Setting browser functions hooks
Unauthorized injection to a system process
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a browser process
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19fe720b-abdb-48c1-b0d0-4e9c39af61c7
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee Xmrig
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/840976
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Send many emails (e-Mail Spam)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to resolve many domain names, but no domain seems valid
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473403 Sample: ZUd8KSXXVD.exe Startdate: 29/08/2021 Architecture: WINDOWS Score: 100 79 zldopo.com 2->79 81 yahopo.com 2->81 83 98 other IPs or domains 2->83 117 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->117 119 Multi AV Scanner detection for domain / URL 2->119 121 Malicious sample detected (through community Yara rule) 2->121 125 24 other signatures 2->125 11 ZUd8KSXXVD.exe 2->11         started        14 dgdeetu 2->14         started        16 svchost.exe 2->16         started        18 11 other processes 2->18 signatures3 123 Tries to resolve many domain names, but no domain seems valid 81->123 process4 dnsIp5 135 Detected unpacking (changes PE section rights) 11->135 21 ZUd8KSXXVD.exe 11->21         started        137 Machine Learning detection for dropped file 14->137 24 dgdeetu 14->24         started        139 Changes security center settings (notifications, updates, antivirus, firewall) 16->139 85 127.0.0.1 unknown unknown 18->85 26 WerFault.exe 18->26         started        signatures6 process7 signatures8 127 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->127 129 Maps a DLL or memory area into another process 21->129 131 Checks if the current machine is a virtual machine (disk enumeration) 21->131 28 explorer.exe 24 21->28 injected 133 Creates a thread in another existing process (thread injection) 24->133 process9 dnsIp10 93 readinglistforaugust7.xyz 28->93 95 readinglistforaugust6.xyz 28->95 97 12 other IPs or domains 28->97 71 C:\Users\user\AppData\Roaming\dgdeetu, PE32 28->71 dropped 73 C:\Users\user\AppData\Local\Temp\B4EE.exe, PE32 28->73 dropped 75 C:\Users\user\AppData\Local\Temp\B38F.exe, PE32 28->75 dropped 77 9 other malicious files 28->77 dropped 141 System process connects to network (likely due to code injection or exploit) 28->141 143 Benign windows process drops PE files 28->143 145 Performs DNS queries to domains with low reputation 28->145 149 2 other signatures 28->149 33 37BB.exe 28->33         started        36 B4EE.exe 2 28->36         started        39 2E92.exe 28->39         started        42 3 other processes 28->42 file11 147 Tries to resolve many domain names, but no domain seems valid 95->147 signatures12 process13 dnsIp14 99 Multi AV Scanner detection for dropped file 33->99 101 Detected unpacking (changes PE section rights) 33->101 103 Query firmware table information (likely to detect VMs) 33->103 115 3 other signatures 33->115 65 C:\Users\user\AppData\Local\...\ubzkpkym.exe, PE32 36->65 dropped 105 Machine Learning detection for dropped file 36->105 107 Uses netsh to modify the Windows network and firewall settings 36->107 109 Modifies the windows firewall 36->109 44 cmd.exe 36->44         started        47 cmd.exe 2 36->47         started        49 sc.exe 36->49         started        53 3 other processes 36->53 87 cdn.discordapp.com 162.159.130.233, 443, 49712 CLOUDFLARENETUS United States 39->87 89 builder.pp.ru 185.244.41.39, 443, 49711, 49719 ASKONTELRU Russian Federation 39->89 111 Injects a PE file into a foreign processes 39->111 91 telete.in 195.201.225.248 HETZNER-ASDE Germany 42->91 67 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 42->67 dropped 113 Contains functionality to steal Internet Explorer form passwords 42->113 51 WerFault.exe 20 9 42->51         started        file15 signatures16 process17 file18 69 C:\Windows\SysWOW64\...\ubzkpkym.exe (copy), PE32 44->69 dropped 55 conhost.exe 44->55         started        57 conhost.exe 47->57         started        59 conhost.exe 49->59         started        61 conhost.exe 53->61         started        63 conhost.exe 53->63         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 02:41:18 UTC
AV detection:
20 of 44 (45.45%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgou3dr6xaxjnvbl3pnxnb64osj6hdan5yrw6onzfsmj35v7yj6q._file
Verdict:
suspicious
Similar samples:
27c106e7c9e455f880849d79759df345d2117aa2e2357696dabb51bc11adce8b
RaccoonStealer
2bb5cb490caca6d8a0dc1bab96ce898765f1f88948a86cd777508319025e8950
RaccoonStealer
3f3fecd695146b28e051593aabcd535dc366932c08bf0011ae997ad6b7e39147
RaccoonStealer
60ab0131b6fa420a6a8039b60ac948db87033e9a8db69b16344e3d9222859556
RaccoonStealer
94eb2ab912a0fc0fb09538da52e4c36a50a1ea22cf6dfefe0b245f1687b8fe8f
RaccoonStealer
b54c24558cf6e2625c473b5703aa2fe21887b7434377fe1d868966a57c5bc483
RaccoonStealer
c55df5e9d0ea176321a29f8957c7a43188796ae0fc0ffe1ae94ad6092d30ba77
RaccoonStealer
ecc608dedd0b55df6c75aeffcd51e11f3fd50d7422e4a1b26d4515a18419b9c4
RaccoonStealer
f4e1fc78ba0a65bde5687a67eb89e20166e062356b77227c9e0211060bd14dc8
RaccoonStealer
f74c97d626730018ba9a8dd5e6fb806bfcc42d15a8b20ef328cc5f0d6a052ccc
RaccoonStealer
+ 4'020 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:d02c5d65069fc7ce1993e7c52edf0c9c4c195c81 botnet:fe582536ec580228180f270f7cb80a867860e010 botnet:word1 backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210829-654y3xvm72/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
94.26.249.88:1902
Unpacked files
SH256 hash:
0a9a7acf77fe4f890fe2acf761fa7f369418bb1f733504acd0792f589ccc7b15
MD5 hash:
ad94a86355be2ad9348b88e8972e8320
SHA1 hash:
8c7ff71739a5194efc5c7bee9c37ad92a9e72646
Link:
https://www.unpac.me/results/2beb4a02-abe7-4f7b-9b5d-40ad6b08bf02/
SH256 hash:
b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d
MD5 hash:
062f484c0443481867f8ef46e84aaf64
SHA1 hash:
6f411a9410c47183e57adf98d5c521059ff1c16b
Link:
https://www.unpac.me/results/2beb4a02-abe7-4f7b-9b5d-40ad6b08bf02/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b99d4d8e3eb8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe b99d4d8e3eb82e96d42bdbdb7687dc7493e38c0dee236f39b92c989df6bfc27d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1558724/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183202/

Comments