MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c686c7b2fff2ad2853c1d450d44fcf96ff3df67f34205b6b4e0352153893c924. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 10
| SHA256 hash: | c686c7b2fff2ad2853c1d450d44fcf96ff3df67f34205b6b4e0352153893c924 |
|---|---|
| SHA3-384 hash: | 512a1da6005d97f4ecb9d79811f1f2356086fc50e5adda23e8c465cbf2ee9c68378156ffe546a103e58b5cb8619a5f8a |
| SHA1 hash: | 66cffe0dc5cb3de1f5c0e754bc0e21e712e756f0 |
| MD5 hash: | 826d68f6e4a2c308e91aad81c8368443 |
| humanhash: | rugby-steak-kansas-four |
| File name: | 826d68f6e4a2c308e91aad81c8368443.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 1'318'912 bytes |
| First seen: | 2020-10-13 16:50:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c527ec4fd7e542f708e9a6ac42ef3593 (5 x RaccoonStealer) |
| ssdeep | 24576:7s50MSJZFvFsSss9TDdfLVMls50MMl+TZMs50MoEP80kKYfu:7s5SJbvFsSdjfyls5s+TZMs5oIkKYfu |
| Threatray | 988 similar samples on MalwareBazaar |
| TLSH | BD5522269A630723F4066E708BD052D117FEBD277282ED1FFB8C252A07D1D464AC76B6 |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Creating a file
Sending a custom TCP request
Deleting a recently created file
Reading critical registry keys
Replacing files
Delayed writing of the file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Sending a TCP request to an infection source
Stealing user critical data
Sending an HTTP POST request to an infection source
Result
Threat name:
AsyncRAT Azorult Raccoon Vidar
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Binary contains a suspicious time stamp
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Detection:
raccoon
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-10-13 16:04:42 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
azorult
masslogger
Similar samples:
+ 978 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
discovery trojan infostealer family:azorult spyware evasion rat family:asyncrat family:oski family:modiloader
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops desktop.ini file(s)
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
ModiLoader First Stage
AsyncRat
Azorult
Contains code to disable Windows Defender
ModiLoader, DBatLoader
Modifies Windows Defender Real-time Protection settings
Oski
Malware Config
C2 Extraction:
:
Unpacked files
SH256 hash:
c686c7b2fff2ad2853c1d450d44fcf96ff3df67f34205b6b4e0352153893c924
MD5 hash:
826d68f6e4a2c308e91aad81c8368443
SHA1 hash:
66cffe0dc5cb3de1f5c0e754bc0e21e712e756f0
SH256 hash:
bb504b4028a76d6cf9774b6049ad22b40c13ebe70c0f95ecbd7abe4684f64647
MD5 hash:
a198b9a7d7312d141e770fc05937d43e
SHA1 hash:
e119533a7c337c94ec71316525dad53d97a9770f
Detections:
win_azorult_g1
win_azorult_auto
SH256 hash:
b457938d84cc2d3665e4ed98c02cfc30bf118d5be8d1221c5bc0b701bfc01f3e
MD5 hash:
f2ccded349f56600711ffb7216639aba
SHA1 hash:
016723ac2cc5cbc5878c1b969642b4ae12d4ba6a
Detections:
win_oski_g0
win_oski_auto
SH256 hash:
6ec8b8722011387a91473b37ca0349b07a8913ef6dd8577758a466ab7dcf8fad
MD5 hash:
c5fd08072b41f2c2ac8f44ed25360539
SHA1 hash:
534b1beaaee160be36c62e5a96330c85ca8cce07
Detections:
win_raccoon_a0
win_raccoon_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | asyncrat |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| Rule name: | Email_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Email in files like avemaria |
| Rule name: | win_asyncrat_w0 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect AsyncRat in memory |
| Reference: | internal research |
| Rule name: | win_oski_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| Rule name: | win_oski_g0 |
|---|---|
| Author: | Slavo Greminger, SWITCH-CERT |
| Rule name: | win_raccoon_a0 |
|---|---|
| Author: | Slavo Greminger, SWITCH-CERT |
| Rule name: | win_raccoon_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.