MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 5 File information Comments

SHA256 hash:	c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e
SHA3-384 hash:	e4c1030c0b6b0f9bede8c1fe8dd2aefd284e93e2b407658ed933ff1e392be5e51160b398c3e12965948a8466d227c392
SHA1 hash:	230204b90ee788fa6ea1aa2144adafd5123f1e87
MD5 hash:	7b4e75f888cf3c831cf67353275ea058
humanhash:	yellow-vermont-timing-island
File name:	7b4e75f888cf3c831cf67353275ea058.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	591'360 bytes
First seen:	2021-03-13 07:40:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9c2408c4e289059dc1f7339d62dec625 (2 x RaccoonStealer, 1 x Formbook)
ssdeep	12288:XYj3tqAiH8+0wrz9KvlDbdwdH1qEAL8HMLSdxPAT:XyTiHJ04sDS+ExHiSd2
Threatray	435 similar samples on MalwareBazaar
TLSH	68C4D000A7A1E034F4B6B6F88B75C374A63979B1972494CFA1D62BEA26746F0DC70317
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
https://letsmakesome.fun/

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7b4e75f888cf3c831cf67353275ea058.exe

Verdict:

Malicious activity

Analysis date:

2021-03-13 07:41:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0bc9296e-4d0f-48b1-92c6-94553115506c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/124052/

Detection(s):

Win.Packed.Tofsee-9840603-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending a UDP request

Sending a TCP request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/638473

Signature

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

raccoon

Link:

https://mwdb.cert.pl/sample/c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e/

Threat name:

Win32.Trojan.StellarStealer

Status:

Malicious

First seen:

2021-03-12 03:49:49 UTC

AV detection:

25 of 47 (53.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ymegudpf2tsij4dhmhnccitauocxgi45hovpntzmoihigforpyha._file

Verdict:

malicious

RaccoonStealer

499e3672259c28f6bd35d790c2ec4f52835cfcd46c8ddf279df4b02d4d07d7e5

RaccoonStealer

66496b0a09ac29095bc092f123a6ce7362ba199fccc1906f27c956312eca9c8c

RaccoonStealer

6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb

RaccoonStealer

71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6

RaccoonStealer

78f5967d8bd5d31343632e8558b9315d9d44d009c923b9c41d417943906f2849

RaccoonStealer

bcc49344ddab6a3271480eafb423ee292ed4b2d32792f1b79ed72db0ad856665

RaccoonStealer

bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac

RaccoonStealer

d0b4ea79bfa3aad2d6343a52811b837c45229253cda7abb26b4df2107ab52d58

RaccoonStealer

e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5

RaccoonStealer

+ 425 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:ddcbd6366de67d1cf1d10203593a074aab7abd55 stealer

Link:

https://tria.ge/reports/210313-as7pj2rt66/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Raccoon

Suspicious use of NtCreateProcessExOtherParentProcess

Unpacked files

SH256 hash:

1aa47cb22e407892616618fe2adc633a245d5dc022bf0f105cc0b7a67a9d6f6a

MD5 hash:

72f6d2ff36798c266ddb0b3755dec951

SHA1 hash:

ce30345693180d024b301dfd0f527343453f30a1

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/5cfb2ea7-bf73-4fbe-a8b0-01a238fd83b9/

Parent samples :

1780d38ef73129177134042720cfc526fe012760f406e9e030d8d5fbbdfb7828
a2a7e43ce1a853842ecb2bdb665b180119d539d56ce2c2eab1a54d098cc92edd
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
c84d7d17bace5f7ab474440491d7c3aa0be6fabbd5fab86106b10a45e4b97bfc
194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2
a3280da75d606d54a450b69372eca59b6f5f3a934e461c68b4d2e38f6223046e
66496b0a09ac29095bc092f123a6ce7362ba199fccc1906f27c956312eca9c8c
106c0169d2464a9efe9ee45c1e7c5863764e6d9fca3809bb249bbb97d3cf3086
c394b83a255961adb3ec0c8e35b21e05ee432b3c758b25ceac7e3dc3a10486a7
bcc49344ddab6a3271480eafb423ee292ed4b2d32792f1b79ed72db0ad856665
bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac
c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e
d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd

SH256 hash:

c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e

MD5 hash:

7b4e75f888cf3c831cf67353275ea058

SHA1 hash:

230204b90ee788fa6ea1aa2144adafd5123f1e87

Link:

https://www.unpac.me/results/5cfb2ea7-bf73-4fbe-a8b0-01a238fd83b9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator