MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf
SHA3-384 hash: cfdfb373f3a0e264ae004728204120eee4bbc3ad5fe3fbb9308f8d881cb68e29714463ad5c6308a74487a5fe75b24328
SHA1 hash: bded90a1af1f05eb84b8bc338b6dbd87242a7019
MD5 hash: b59298142204c67f7d1de090683c8379
humanhash: nitrogen-montana-venus-washington
File name:b59298142204c67f7d1de090683c8379.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:142'848 bytes
First seen:2021-08-29 17:17:00 UTC
Last seen:2021-08-29 17:59:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6af2f376c26d45636195772a4c22fdda (12 x RaccoonStealer, 5 x Stop, 3 x Amadey)
ssdeep 3072:kuf6XI3KIfZh6rtQo/8KhDsfCHhOhsI5/DuT61m:zeKKIfnaIKhMhsI5/
Threatray 3'947 similar samples on MalwareBazaar
TLSH T12AD3C00571B1C473C5C619B24829E662677FBA316B74DA873B5807AF3E722C0872E393
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://5.181.156.252/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.252/ https://threatfox.abuse.ch/ioc/201911/

Intelligence

File Origin
# of uploads :
2
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b59298142204c67f7d1de090683c8379.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-29 17:19:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3ed8034c-469d-44af-9f7b-752fa7723eab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183287/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.12980.31048.30212.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending a UDP request
Sending an HTTP POST request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Searching for the window
Reading critical registry keys
Sending an HTTP GET request
Sending a custom TCP request
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a browser process
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a496584-b5c3-456d-b428-c836084f4031
Result
Threat name:
Raccoon RedLine SmokeLoader Zeppelin
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/841096
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Deletes shadow drive data (may be related to ransomware)
Detected unpacking (changes PE section rights)
Drops PE files with benign system names
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Yara detected RansomwareGeneric
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Zeppelin Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473527 Sample: LeSA7F7a96.exe Startdate: 29/08/2021 Architecture: WINDOWS Score: 100 62 www.geodatatool.com 2->62 64 geoiptool.com 2->64 66 api.ip.sb 2->66 94 Found malware configuration 2->94 96 Malicious sample detected (through community Yara rule) 2->96 98 Antivirus detection for URL or domain 2->98 100 15 other signatures 2->100 10 LeSA7F7a96.exe 2->10         started        13 etjacab 2->13         started        signatures3 process4 signatures5 116 Detected unpacking (changes PE section rights) 10->116 118 Contains functionality to inject code into remote processes 10->118 120 Injects a PE file into a foreign processes 10->120 15 LeSA7F7a96.exe 10->15         started        122 Machine Learning detection for dropped file 13->122 18 etjacab 13->18         started        process6 signatures7 150 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->150 152 Maps a DLL or memory area into another process 15->152 154 Checks if the current machine is a virtual machine (disk enumeration) 15->154 20 explorer.exe 17 15->20 injected 156 Creates a thread in another existing process (thread injection) 18->156 process8 dnsIp9 68 185.49.70.90, 2080 LEASEWEB-DE-FRA-10DE United Kingdom 20->68 70 readinglistforaugust2.xyz 95.213.224.6, 49729, 80 SELECTELRU Russian Federation 20->70 72 10 other IPs or domains 20->72 50 C:\Users\user\AppData\Roaming\etjacab, PE32 20->50 dropped 52 C:\Users\user\AppData\Local\Temp\F613.exe, PE32 20->52 dropped 54 C:\Users\user\AppData\Local\Temp\F18E.exe, PE32 20->54 dropped 56 6 other malicious files 20->56 dropped 108 System process connects to network (likely due to code injection or exploit) 20->108 110 Benign windows process drops PE files 20->110 112 Performs DNS queries to domains with low reputation 20->112 114 2 other signatures 20->114 25 F613.exe 20->25         started        30 E47C.exe 15 5 20->30         started        32 explorer.exe 20->32         started        34 12 other processes 20->34 file10 signatures11 process12 dnsIp13 80 geoiptool.com 25->80 82 www.geodatatool.com 158.69.65.151, 443, 49746, 49747 OVHFR Canada 25->82 58 C:\Users\user\AppData\Roaming\...\smss.exe, PE32 25->58 dropped 124 Multi AV Scanner detection for dropped file 25->124 126 May check the online IP address of the machine 25->126 128 Machine Learning detection for dropped file 25->128 130 Drops PE files with benign system names 25->130 36 smss.exe 25->36         started        84 136.243.65.8, 48715, 49758 HETZNER-ASDE Germany 30->84 86 api.ip.sb 30->86 132 Detected unpacking (changes PE section rights) 30->132 134 Query firmware table information (likely to detect VMs) 30->134 136 Tries to detect sandboxes and other dynamic analysis tools (window names) 30->136 146 2 other signatures 30->146 40 conhost.exe 30->40         started        88 readinglistforaugust8.xyz 32->88 138 System process connects to network (likely due to code injection or exploit) 32->138 140 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->140 142 Tries to steal Mail credentials (via file access) 32->142 144 Performs DNS queries to domains with low reputation 32->144 90 95.217.117.91, 21361, 49761 HETZNER-ASDE Germany 34->90 92 2 other IPs or domains 34->92 60 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 34->60 dropped 148 2 other signatures 34->148 42 WerFault.exe 20 9 34->42         started        44 WerFault.exe 9 34->44         started        46 conhost.exe 34->46         started        48 WerFault.exe 34->48         started        file14 signatures15 process16 dnsIp17 74 iplogger.org 88.99.66.31, 443, 49754, 49755 HETZNER-ASDE Germany 36->74 76 www.geodatatool.com 36->76 78 geoiptool.com 36->78 102 Multi AV Scanner detection for dropped file 36->102 104 May check the online IP address of the machine 36->104 106 Machine Learning detection for dropped file 36->106 signatures18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 17:17:04 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yr56qrkxgo5vb6yzdv2huw34iqt7vyegffx7x3oczv6cgw6rss7q._file
Verdict:
suspicious
Similar samples:
11d175a08e1f4fc351af4e4c2c0549168d4c235a497f3bc1f278e8cb46b972e1
RaccoonStealer
5152274dbe1cc44da156f29d1ff2858e583237bdc24ced137265cd3668ba851e
RaccoonStealer
5fc5ab3f922510924c13f1018ba4d5d94f990f3885da41d68a38603020cf9b27
RaccoonStealer
608248c1ef7bab54f8a7aeffaf618187a6f20d3bc829a6c6de625e2a2a376f2b
RaccoonStealer
78f958d430a4dec84e4126958d0bde722beab77f03f1ecd733ba94827997dec7
RaccoonStealer
92e576963128d956b98f423af33a3a2395e6a16f7d44855cfc2fff71c0651329
RaccoonStealer
a19317b14abc6d4c1294aaaeab29d0ada023dffa37025c839671c193a74fd519
RaccoonStealer
e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25
RaccoonStealer
+ 3'937 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:buran family:raccoon family:redline family:smokeloader botnet:20d9c80657d1d0fda9625cbd629ba419b8a34404 botnet:d02c5d65069fc7ce1993e7c52edf0c9c4c195c81 botnet:fe582536ec580228180f270f7cb80a867860e010 backdoor discovery evasion infostealer persistence ransomware spyware stealer themida trojan
Link:
https://tria.ge/reports/210829-aaeef1bmse/
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Deletes shadow copies
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Buran
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
95.217.117.91:21361
Unpacked files
SH256 hash:
0a9a7acf77fe4f890fe2acf761fa7f369418bb1f733504acd0792f589ccc7b15
MD5 hash:
ad94a86355be2ad9348b88e8972e8320
SHA1 hash:
8c7ff71739a5194efc5c7bee9c37ad92a9e72646
Link:
https://www.unpac.me/results/4d96dea7-91f8-48aa-affc-3782b24a6d1d/
SH256 hash:
c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf
MD5 hash:
b59298142204c67f7d1de090683c8379
SHA1 hash:
bded90a1af1f05eb84b8bc338b6dbd87242a7019
Link:
https://www.unpac.me/results/4d96dea7-91f8-48aa-affc-3782b24a6d1d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c47be8455733/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1558724/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183287/

Comments