MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc
SHA3-384 hash: cc14898ac2f92f974940a74bd48f695359d7e09f2ad5186c42dac42889aedeca1e8465578d26e7bb29d27f0923bd6844
SHA1 hash: 151a4b123c9d65639a07be0ffea27e0d22fbadea
MD5 hash: e3dc886a7d255f7ec8bd4437f48e2bb6
humanhash: oklahoma-lamp-ink-massachusetts
File name:e3dc886a7d255f7ec8bd4437f48e2bb6.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:4'016'128 bytes
First seen:2021-12-25 12:42:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c284fa365c4442728ac859c0f9ed4dc5 (94 x RedLineStealer, 10 x RaccoonStealer, 8 x CoinMiner)
ssdeep 98304:5swnJF5g3JZIa4zXtbPSfklZbGLwCYZfhT:5swLq34a4zXdKfsZbGLwCGV
TLSH T1DE063399B7E53BD6C3CE4BFC6E90D333129428D2B4B8B98D2918CFA07FD59D50254622
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e3dc886a7d255f7ec8bd4437f48e2bb6.exe
Verdict:
Malicious activity
Analysis date:
2021-12-25 12:45:15 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/04f370a1-22ac-4698-8008-a78276610015

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216370/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Sending an HTTP GET request
DNS request
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3211/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c711daec6c6c14a9f1bc30/reports/ba34fd7f-4c75-4fab-b7fd-b35868a37dbe/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/526da631-a939-494c-9fc5-1b7a74ce9136
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/912756
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 545234 Sample: XF07sq0j6m.exe Startdate: 25/12/2021 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->34 36 Antivirus detection for URL or domain 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 4 other signatures 2->40 8 XF07sq0j6m.exe 2->8         started        process3 signatures4 42 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 8->42 44 Writes to foreign memory regions 8->44 46 Allocates memory in foreign processes 8->46 48 2 other signatures 8->48 11 AppLaunch.exe 83 8->11         started        process5 dnsIp6 30 178.62.232.173, 49750, 80 DIGITALOCEAN-ASNUS European Union 11->30 32 185.163.204.21, 49749, 80 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE Germany 11->32 22 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 11->22 dropped 24 C:\Users\user\AppData\LocalLow\...\nss3.dll, PE32 11->24 dropped 26 C:\Users\user\AppData\...\mozglue.dll, PE32 11->26 dropped 28 56 other files (none is malicious) 11->28 dropped 50 Tries to steal Mail credentials (via file / registry access) 11->50 52 Tries to harvest and steal browser information (history, passwords, etc) 11->52 54 DLL side loading technique detected 11->54 16 cmd.exe 1 11->16         started        file7 signatures8 process9 process10 18 conhost.exe 16->18         started        20 timeout.exe 1 16->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc/
Threat name:
Win32.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-12-25 12:43:18 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zpodxpdrn5ses5nt4fx2yd4adubygrathfxu7kz32tgica4wnxoa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211225-pxxresghek/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
f549df4216291a592e918e61f4838461bf89a31098a9629b55e82c739a7f959c
MD5 hash:
b6dc332dc2943c8dee2c891ec286ed29
SHA1 hash:
4ea7f328052feb16866bf78921602f6d1b079abf
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/5b84e3fc-c34f-4341-8c34-c19e5760c874/
Parent samples :
91fa150a46d5e21128a48e44131717ed4e6aa3074004374b6c9614bf6abbcda3
cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc
SH256 hash:
2d440fa28a07f4c331e8e548e366a454a5ce124a76f142d48013f3e96c9aa4a7
MD5 hash:
40494f0c74f82c00fb056024a7ce7708
SHA1 hash:
73b4d7bc7b681c3ff2dd9c26945ab805c29df613
Link:
https://www.unpac.me/results/5b84e3fc-c34f-4341-8c34-c19e5760c874/
SH256 hash:
cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc
MD5 hash:
e3dc886a7d255f7ec8bd4437f48e2bb6
SHA1 hash:
151a4b123c9d65639a07be0ffea27e0d22fbadea
Link:
https://www.unpac.me/results/5b84e3fc-c34f-4341-8c34-c19e5760c874/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cbdc3bbc716f644975b3e16fac0f801d03834413396f4fab3bd4cc8103966ddc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216370/

Comments