MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bff76665fd4f574a2a8481b085f40148d95272a1cda7332566433e93e1a3b498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 5 File information Comments

SHA256 hash:	bff76665fd4f574a2a8481b085f40148d95272a1cda7332566433e93e1a3b498
SHA3-384 hash:	8ead3cec01d426b9237df3988004b3d9f4a8dcfd0c769ad44bc0fa6b4622cbddf353c0ebf42194e58f841587a7195c6d
SHA1 hash:	7695737cc4d155e12622d888b51f392331d1bd89
MD5 hash:	53a1bc2f1b8f45292dfe1a5595949bc6
humanhash:	two-oregon-ceiling-undress
File name:	53a1bc2f1b8f45292dfe1a5595949bc6.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	558'080 bytes
First seen:	2021-05-28 15:20:12 UTC
Last seen:	2021-05-28 15:42:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a31151b8599e7385dee2461451ee66a3 (4 x RaccoonStealer, 3 x Stop, 1 x CryptBot)
ssdeep	12288:b28r5lcAh+GMnOzXhuCD2LBcH4ALZS/k7G0J+Oj3iy6r:v5lKODhuCqLB6NtS87SOjyy
Threatray	702 similar samples on MalwareBazaar
TLSH	DCC4D030A6A1D038F1F311F849B592BCA53A3DB36B3480CF52D42AEA4674AE5ED31753
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://45.153.230.32/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://45.153.230.32/	https://threatfox.abuse.ch/ioc/66258/

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

53a1bc2f1b8f45292dfe1a5595949bc6.exe

Verdict:

Malicious activity

Analysis date:

2021-05-28 16:01:12 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/304f8999-3606-4863-8619-f6a9dad40b32

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/162990/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46371417.11189.8150.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/793917

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bff76665fd4f574a2a8481b085f40148d95272a1cda7332566433e93e1a3b498/

Threat name:

Win32.Infostealer.Racealer

Status:

Malicious

First seen:

2021-05-27 20:29:05 UTC

AV detection:

17 of 29 (58.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x73wmzp5j5luukueqgyil5abjdmve4vbzwttgjlgim7jhyndwsma._file

Verdict:

malicious

RaccoonStealer

54fd2d3eff97caa7dff88d9f1b8c79d650a88c4d7e64a99656ead19db5946b1a

RaccoonStealer

653d9d0ae06efd8ebb84a079bb7024cd5d2faa497c780ecc2b642f4c3b782cd3

RaccoonStealer

728147c5bff90b21c7aa0b213108ac3a1dbd8a059c129103b35a206ff9be56bb

RaccoonStealer

8e122077ba6cfee5a7da56a8083baf428153e7930e14e9c44925c17707fc226c

RaccoonStealer

8e98d227ab95b2d3e727ed670d1faa260157f6a595aa1026035606424f4509c9

RaccoonStealer

a03efc41514b08958e5597ebb2e1b1e758d1c4ef8d991248626122ec2773c811

RaccoonStealer

c50339202bebf620f50f539aa41632031d42ed3e640bbc210e50502bdb403856

RaccoonStealer

e809c0bff233e36703cedc4d53af9d5ffbaf94b21d7af62f147765ffdafa6d18

RaccoonStealer

fe12a8772f3bb4fc8eb97e4a4a5470cbdaf44178281318a73a052eb43078bafb

RaccoonStealer

+ 692 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:7f6f1a71bebae5a113e0de986c62d83471cee5c8 stealer

Link:

https://tria.ge/reports/210528-zq7n3ak2la/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Raccoon

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bff76665fd4f574a2a8481b085f40148d95272a1cda7332566433e93e1a3b498

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator