MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8fe81088b2caa9df35d92a588fb266a145c95b81b5c66d5bfe181fa73b17d82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA File information Comments

SHA256 hash:	c8fe81088b2caa9df35d92a588fb266a145c95b81b5c66d5bfe181fa73b17d82
SHA3-384 hash:	ca227ba1c3251adc16085b233cc52d8838a3590f18e3a4a68693b78b5073a5f0100201838b5ac12349058f18f6065dd9
SHA1 hash:	f87c7511d2c4ea4894603d3cfddd478c8c2b3ead
MD5 hash:	9af4d2022dc05c2dbbc4d218a8f0974c
humanhash:	dakota-oranges-monkey-blue
File name:	9af4d2022dc05c2dbbc4d218a8f0974c.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	319'488 bytes
First seen:	2022-01-14 09:36:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	80fec6fca6f81033220e34b44810dbfd (3 x RaccoonStealer)
ssdeep	6144:dTIJAM3EC/eddUaHyF9mqcMuS9W1uPVeHcENjQe:dY3EIWU9/pcO9rPVeqe
Threatray	7'332 similar samples on MalwareBazaar
TLSH	T1B2649D10BBA0C436F4B722F846B5936DBA3E7EA1573450CB22D52AEE56346E0EC31717
File icon (PE):
dhash icon	25ec1378399b9b91 (23 x RedLineStealer, 13 x Smoke Loader, 7 x RaccoonStealer)
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
65.108.104.175:1193

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
65.108.104.175:1193	https://threatfox.abuse.ch/ioc/295071/

Intelligence

File Origin

# of uploads :

# of downloads :

266

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9af4d2022dc05c2dbbc4d218a8f0974c.exe

Verdict:

Suspicious activity

Analysis date:

2022-01-14 10:10:56 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5e163510-4451-48be-9865-b0663fcb3d8f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/219283/

Detection(s):

Win.Packed.Tofsee-9935687-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

Searching for synchronization primitives

Running batch commands

Launching a process

Delayed reading of the file

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/4176/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware tofsee

Link:

https://www.filescan.io/uploads/61e14446f2e8ec86fefc2f88/reports/ddbabb76-37e5-4d76-98a9-ca34ac60ca2a/overview

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3ee571b9-300a-4193-9ea0-e1359948db8f

Result

Threat name:

Amadey Raccoon RedLine SmokeLoader Tofse

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/920640

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file has nameless sections

Sigma detected: Copying Sensitive Files with Credential Data

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

Sigma detected: Suspicius Add Task From User AppData Temp

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction which cause usermode exception

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Amadey bot

Yara detected Amadeys stealer DLL

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c8fe81088b2caa9df35d92a588fb266a145c95b81b5c66d5bfe181fa73b17d82/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-01-14 09:05:21 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 43 (72.09%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zd7iccelfsvj3425sksyr6zgnikfzfnydnognvn74ga7u45rpwba._file

Verdict:

malicious

RaccoonStealer

587e1548861c1d728e458c1a01c5d7778a9981c292f472d0e53b762e52c3112f

RaccoonStealer

6e52d162baf265e070ec1a3147ad651d8bd8481d96b33cee1b89d84e9c92c5f3

RaccoonStealer

9c4589a85be4f674a2d7116f152d4699e4198c478da2d2c8d68e6872acbe248a

RaccoonStealer

e997341ab2422f5471f4c9f1df84f7a52e16fa38d64e6e0f4f94859cc234e2f8

RaccoonStealer

f4d4948b257b6e4dac5b3cdab1b50cd2ed1035d3584da8dc6482c0774445f26c

RaccoonStealer

+ 7'322 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:amadey family:arkei family:smokeloader family:tofsee family:xmrig botnet:default backdoor collection discovery evasion miner persistence spyware stealer suricata trojan

Link:

https://tria.ge/reports/220114-lljhwafffn/

Behaviour

outlook_win_path

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Creates scheduled task(s)

Checks SCSI registry key(s)

Program crash

Enumerates physical storage devices

Launches sc.exe

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Loads dropped DLL

Deletes itself

Sets service image path in registry

Modifies Windows Firewall

Executes dropped EXE

Downloads MZ/PE file

Creates new service(s)

XMRig Miner Payload

Arkei Stealer Payload

xmrig

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Amadey CnC Check-In

Windows security bypass

Tofsee

Suspicious use of NtCreateProcessExOtherParentProcess

SmokeLoader

Arkei

Amadey

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
http://file-file-host4.com/tratata.php
patmushta.info
parubey.info
185.215.113.35/d2VxjasuwS/index.php