MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
SHA3-384 hash: 545476577f751f16bb34591d1958471bdd97954bf4f6ce012c5115b8b931201e4e6599664d4ed2753515073f1224ac93
SHA1 hash: e5ce952e62af7efc484826c512a6f9b363b21877
MD5 hash: 82a0a0bd6084c5a28081310e75e7f608
humanhash: washington-carpet-hotel-quebec
File name:82a0a0bd6084c5a28081310e75e7f608.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'527'808 bytes
First seen:2020-11-19 06:18:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8ae5ffa9cbb2cc410236b25170b3af92 (3 x RaccoonStealer, 1 x BitRAT, 1 x ArkeiStealer)
ssdeep 24576:Fs50MV0ORVeA8iFZwkyIVH8oPMp4ySs50MIpNSlzqs50M0IW9KK5jNSDUXNSW1:Fs5VXh8lkHVHLMSs5IpIlzqs50h9KajX
Threatray 1'746 similar samples on MalwareBazaar
TLSH 21651223AA229153F0290AB089E7A7E6277E7C137A035E1FF74C7A2D5FB82461CD0575
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a custom TCP request
DNS request
Creating a file
Deleting a recently created file
Reading critical registry keys
Replacing files
Delayed writing of the file
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Launching a tool to kill processes
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT Azorult Raccoon
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/542259
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 320229 Sample: 07DYwxlVm4.exe Startdate: 19/11/2020 Architecture: WINDOWS Score: 100 102 agentpurple.ac.ug 2->102 104 agentttt.ac.ug 2->104 126 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->126 128 Found malware configuration 2->128 130 Malicious sample detected (through community Yara rule) 2->130 132 12 other signatures 2->132 12 07DYwxlVm4.exe 16 2->12         started        signatures3 process4 file5 98 C:\Users\user\AppData\Local\...\FGbfttrev.exe, PE32 12->98 dropped 100 C:\Users\user\AppData\...\FDvbcgfert.exe, PE32 12->100 dropped 154 Detected unpacking (changes PE section rights) 12->154 156 Detected unpacking (overwrites its own PE header) 12->156 158 Maps a DLL or memory area into another process 12->158 16 FGbfttrev.exe 4 12->16         started        19 07DYwxlVm4.exe 87 12->19         started        23 FDvbcgfert.exe 4 12->23         started        signatures6 process7 dnsIp8 116 Detected unpacking (changes PE section rights) 16->116 118 Maps a DLL or memory area into another process 16->118 25 FGbfttrev.exe 71 16->25         started        106 puffpuff423.top 104.27.133.115, 443, 49732 CLOUDFLARENETUS United States 19->106 108 telete.in 195.201.225.248, 443, 49725 HETZNER-ASDE Germany 19->108 110 192.168.2.1 unknown unknown 19->110 72 C:\Users\user\AppData\...\8tWRgqgwV5.exe, PE32 19->72 dropped 74 C:\Users\user\AppData\...\ZHuaqbV7em.exe, PE32 19->74 dropped 76 C:\Users\user\AppData\...\Rl4gPkZZCT.exe, PE32 19->76 dropped 78 60 other files (none is malicious) 19->78 dropped 120 Tries to steal Mail credentials (via file access) 19->120 122 Hides threads from debuggers 19->122 30 8tWRgqgwV5.exe 19->30         started        32 cmd.exe 19->32         started        34 ZHuaqbV7em.exe 19->34         started        38 2 other processes 19->38 124 Detected unpacking (overwrites its own PE header) 23->124 36 FDvbcgfert.exe 188 23->36         started        file9 signatures10 process11 dnsIp12 112 taenaiaa.ac.ug 217.8.117.77, 49726, 49727, 49730 CREXFEXPEX-RUSSIARU Russian Federation 25->112 114 morasergiox.ac.ug 25->114 82 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 25->82 dropped 84 C:\Users\user\AppData\Local\Temp\ds2.exe, PE32 25->84 dropped 86 C:\Users\user\AppData\Local\Temp\ac.exe, PE32 25->86 dropped 94 49 other files (none is malicious) 25->94 dropped 138 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->138 140 Tries to steal Instant Messenger accounts or passwords 25->140 142 Tries to steal Mail credentials (via file access) 25->142 152 2 other signatures 25->152 40 ac.exe 25->40         started        44 ds2.exe 25->44         started        46 cmd.exe 25->46         started        54 2 other processes 25->54 144 Injects a PE file into a foreign processes 30->144 48 conhost.exe 32->48         started        50 timeout.exe 32->50         started        88 C:\ProgramData\vcruntime140.dll, PE32 36->88 dropped 90 C:\ProgramData\sqlite3.dll, PE32 36->90 dropped 92 C:\ProgramData\softokn3.dll, PE32 36->92 dropped 96 4 other files (none is malicious) 36->96 dropped 146 Tries to harvest and steal browser information (history, passwords, etc) 36->146 148 Tries to steal Crypto Currency Wallets 36->148 150 Hides threads from debuggers 36->150 52 cmd.exe 36->52         started        file13 signatures14 process15 file16 80 C:\Users\user\AppData\Roaming\...\vxcalc.exe, PE32 40->80 dropped 134 Creates an undocumented autostart registry key 40->134 136 Injects a PE file into a foreign processes 40->136 56 ds2.exe 44->56         started        58 conhost.exe 46->58         started        60 timeout.exe 46->60         started        62 conhost.exe 52->62         started        64 taskkill.exe 52->64         started        66 ds1.exe 54->66         started        signatures17 process18 process19 68 powershell.exe 56->68         started        process20 70 conhost.exe 68->70         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d/
Threat name:
Win32.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 20:49:51 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xli753yakwbv3nhyss2iqw2i2wlhrbcyxsijlvgav6pmg2uxa56q._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
remcos
Create hunting rule
azorult
Create hunting rule
Similar samples:
286c2eb8755215619d8cb48cc884091251729d5925b74444fe3b62c2c1a5acb5
RaccoonStealer
2bea53a14d59fc7d772ea805af47b3b8ddddbf201a7e8d9e7ebd7ca422702a30
RaccoonStealer
308c96557c6be5d4519ba4bac38c23e611c7b61683cfc1063a6009e216c24f5e
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
682be0853ccd6f60deb69d27941a628758c4e13e7d2e6ee95a95f415f3a9f0c6
RaccoonStealer
69fe5bb4b975f9437b6c3bcf3f07dc807a8f2e848f1e0c5802012295b06a742c
RaccoonStealer
77d3172d77aa45c61b8563dcb13b26bd2f8f9fb4cbc2fcc966966a26f316ba56
RaccoonStealer
8bbb8fe69100550248f4663e911a16bca03432bef9112dd0924d7a9c3dae8464
RaccoonStealer
9b1328490717e1e3c97216a17bf36b67103a40dae3bbac6865487e51fea82b32
RaccoonStealer
c9c5b4b76ac69632d5f5931198adb5d21d214c72d8524ffc60d7d6bbcd44cf03
RaccoonStealer
+ 1'736 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:modiloader family:oski family:raccoon family:remcos discovery evasion infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/201119-chjs7k18ca/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Async RAT payload
ModiLoader First Stage
ServiceHost packer
AsyncRat
Azorult
Contains code to disable Windows Defender
ModiLoader, DBatLoader
Modifies Windows Defender Real-time Protection settings
Oski
Raccoon
Remcos
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
taenaia.ac.ug:6969
agentpapple.ac.ug:6969
Unpacked files
SH256 hash:
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
MD5 hash:
82a0a0bd6084c5a28081310e75e7f608
SHA1 hash:
e5ce952e62af7efc484826c512a6f9b363b21877
Link:
https://www.unpac.me/results/73a908a1-7074-45a8-a2a2-f334a1332b55/
SH256 hash:
62dc29f6d17815486d05246e2f2f963a8dd7ac2c098cd4f6e2985742d1add0ff
MD5 hash:
600d915992e86911f8e261c677e87a7d
SHA1 hash:
d1ae5a5cc4590dc4bd03fa2742f2c083ee903f50
Link:
https://www.unpac.me/results/73a908a1-7074-45a8-a2a2-f334a1332b55/
SH256 hash:
dcd3aea60bebd16c5fd39ceeaa88c776ac6db07fe91bc1f36734afd06642bc9c
MD5 hash:
3e9b00a0fc88696048590775e0d57334
SHA1 hash:
f1a4f51d6e385d78d2e1845de5b4843448f84667
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/73a908a1-7074-45a8-a2a2-f334a1332b55/
SH256 hash:
5209777ffbc5ffc61e6be54b70a2ffa324ad57e8c265c1b2cfe02a2b49f1f2f0
MD5 hash:
afb64c4ad37a51d28081eeca3595c209
SHA1 hash:
cb21f861470b0d1d6424649e72d664c8ba16b143
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/73a908a1-7074-45a8-a2a2-f334a1332b55/
SH256 hash:
873d80ee3f607abd9259b2da6a7152caefdefd8bed248e211e8f0ada3bede046
MD5 hash:
839bc6cdabd3bf463c9744a3f167a356
SHA1 hash:
343fff8252a4054762568c0532c44677bf986c06
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/73a908a1-7074-45a8-a2a2-f334a1332b55/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_a0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/584190/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/677624/
  
URLhaus
https://urlhaus.abuse.ch/url/820569/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
  
URLhaus
https://urlhaus.abuse.ch/url/677630/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/791302/
  
URLhaus
https://urlhaus.abuse.ch/url/615227/
  
URLhaus
https://urlhaus.abuse.ch/url/791257/
  
URLhaus
https://urlhaus.abuse.ch/url/446431/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/615226/

Comments