MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba4dee2bcb05cefbf4246e6fbae7e02af20c0ae7039a3227877e55071d5f6be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	ba4dee2bcb05cefbf4246e6fbae7e02af20c0ae7039a3227877e55071d5f6be1
SHA3-384 hash:	fc4e2f447e42d99a39f0269617ea21d95c701530f2ec8ad70a65ec781e1b9d2c2d39a63c332d3d67c502af87e3dc34cf
SHA1 hash:	984cfae71221bdf03b2fad0caae6f7bbb54902d2
MD5 hash:	aea94403246e276c5beb2c1088936030
humanhash:	sixteen-fish-november-india
File name:	aea94403246e276c5beb2c1088936030.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	544'256 bytes
First seen:	2020-06-19 06:06:23 UTC
Last seen:	2020-06-19 07:04:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	df787be49757cc4a97d89300f624c045 (4 x RaccoonStealer)
ssdeep	6144:SFNMMnckCMocLtAxiSfPQl5k37101fiCpHoyR2laZ7hZGBmuJj7nYn57D:mN3c3jlNfPdcfi8oyR2laZ7aY6YnVD
TLSH	45C4F100A2E1DC27F0A23A3D4CA4DA503A2EFD9149B1C50BB7847F6E1DF51E066B5F66
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://35.226.139.169/gate/log.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/9464/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-06-19 00:23:27 UTC

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xjg64k6laxhpx5benzx3vz7aflzaycxhaondej4hpzkqohk7npqq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

6/10

Tags:

evasion spyware trojan

Link:

https://tria.ge/reports/200624-zcqg8ah6y2/

Behaviour

Modifies system certificate store

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_raccoon_a0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator