MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036
SHA3-384 hash: cbf533ca840304c781e795718b1e86fee2fac56060f2c5e04335d8560f45155319840b8fb3de24a87b2f69474328d3dd
SHA1 hash: b009e448b2671ca8b4c143d42ab4170d187b45e3
MD5 hash: b2708893f54cd6e5d543827af3256657
humanhash: seven-mars-mango-september
File name:b2708893f54cd6e5d543827af3256657
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:505'856 bytes
First seen:2021-07-23 15:04:08 UTC
Last seen:2021-07-23 17:27:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e65b83417738f666152fabcdb3753ddc (8 x RaccoonStealer, 3 x Glupteba, 3 x RedLineStealer)
ssdeep 6144:vg1sGQD9D2E3SEFYAukpYmkmfhpllP470sn48V/0trjuwDOBPAn:nGyD/3SsJ6JqY48V8tJDOBPA
Threatray 1'682 similar samples on MalwareBazaar
TLSH T123B40110FAB0C873D0950B7458DAC650A62CBC32BA70EE4636A72F6E2F711E1767525F
dhash icon 48b9b2b0e8c38890 (13 x RaccoonStealer, 5 x RedLineStealer, 3 x Glupteba)
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.234.247.50/ https://threatfox.abuse.ch/ioc/162348/

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b2708893f54cd6e5d543827af3256657
Verdict:
Malicious activity
Analysis date:
2021-07-23 15:09:05 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/1540d467-ba9f-47d3-98f3-cd3ff1f048b4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173666/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.9848.11757.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6410d14c-948e-4d3f-93ed-20555bace743
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820857
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 15:05:11 UTC
AV detection:
26 of 27 (96.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5d6tkw2kejzcvq7r26szqy3bkrrkhkpvuiy2v76co7uuwqvua3a._file
Verdict:
malicious
Similar samples:
2dea3932c1757b97794f9695077e24ac9c303be27f714d60649d0c10a806c954
RaccoonStealer
41a0994823dcd4c0556cffa6f62e8ef68ccc30575f7c0c5769eb0ec312d6d370
RaccoonStealer
4c13f894dc3fedf1f1a0388cbdd003803e6addf8e1a666bea37fbb03aac865f8
RaccoonStealer
572f68d6d174b6a758ad3f0c4a7cedc51431c629b5419222101ab6f5ba2fc255
RaccoonStealer
777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4
RaccoonStealer
865e5da4d6d27498a82f1cf6ef3b3becebf47887045999d73ce05a00131b5fe6
RaccoonStealer
8990e30dc8b1ed034d76dd4997dd9cefe06b0a731d44edeafe8dd1e4dabb6347
RaccoonStealer
a02b64dc93daa45710a48d618f107e0ad5ac36b1b4ec65dfffa5b9a217f3364f
RaccoonStealer
ee22929b148bbbc5527e628d58085c517b34f546f6d06625a6e81f030f8e5d89
RaccoonStealer
f97fc1542ab5f62402203c2e36ce0b8984ae68545b575ae160bb14caf53f2803
RaccoonStealer
+ 1'672 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210723-15ee83v6lj/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of WriteProcessMemory
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
fd34bb80cd2642402f1ebf9b2e3b9bbf2b7e26d654dd0d7102a527a6535eb9fd
MD5 hash:
613731ab8c536d7f17415db88b093c18
SHA1 hash:
8eea7274b1094cffc0d61e2ae24581847bf9896b
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/95746390-979f-4001-a657-0f2a5ba70814/
Parent samples :
5f961bb251b5cced26c85957ba0c0b2f74a1f7c0a1edd2095c5b8c4bfb344b44
d2bab01fe3f3615831a146acbe0b099deb680545132eb28a0f1e42e37aa3870b
9a89d59fd9fc97f37e19fd750bff125617632780fe9061aebd5988037e0101ba
145793398014dea6cf0cdb29c644cc1156cccf80949bbd6a013237b9481a6451
ee22929b148bbbc5527e628d58085c517b34f546f6d06625a6e81f030f8e5d89
a02b64dc93daa45710a48d618f107e0ad5ac36b1b4ec65dfffa5b9a217f3364f
4c13f894dc3fedf1f1a0388cbdd003803e6addf8e1a666bea37fbb03aac865f8
2dea3932c1757b97794f9695077e24ac9c303be27f714d60649d0c10a806c954
f97fc1542ab5f62402203c2e36ce0b8984ae68545b575ae160bb14caf53f2803
e3168c6e143525f0604f8e6a81dda4e8c485b8f96e9c94638d97c8db272b7936
41a0994823dcd4c0556cffa6f62e8ef68ccc30575f7c0c5769eb0ec312d6d370
865e5da4d6d27498a82f1cf6ef3b3becebf47887045999d73ce05a00131b5fe6
ca2edb79a9c558fcc52a3ce5b3767dadf832036a260f9aad37bf2cfb2725c52a
572f68d6d174b6a758ad3f0c4a7cedc51431c629b5419222101ab6f5ba2fc255
8990e30dc8b1ed034d76dd4997dd9cefe06b0a731d44edeafe8dd1e4dabb6347
777e04a472a2e938f1fd85b68efe6c90720d899a8e007700a9dbfc38569a39c4
cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036
52db6bc60a654f5eaf0c9c85646df732803a058f0c55f1782c6e61de692fef10
2db7b2e33ee548da42c807ee9a9526274db41bf6a23312e2829f2ca5593914b2
dd9ed65eb3bd99b6627c940b7de0a44cf06ef5ae4cfb68aae7897bf2e42db528
45c7559f4e8ca5536943f7b61a57ef0f4c7917507490c771d0b7d85bef89d92f
37137c97a81252bf7a3653ca231b1ac8653d99d6df4d24597f1a09eaefd3072b
449e6629db78334ee22d55526c2b4b6ac5842948b86486e8b5cd6197518389c4
aba364467d21e100381db1e20d17ef011353050a14dd863cc79ad601debe0343
cada28cf855a9059f761e89e4441797a92aed1e4a5878c2e87171090295dcaea
3767b2aa5033d8a966e8217dec4af05cc994b76347411b41599e3e4309ea3d98
f5be0ec35ef75583d71757fee81cff2d190b06fcf5dcd3683ebc2959472556db
c9459ace7e2f1d2e5a8a2afb4c3b6ab8cc88a0c2ca0d9781c045cc86ef36e6c8
4acbafb8a79411abf461bc4ebe4ad1efe4abe663adcd7972588f6e98715217d8
35ef835c77b1e02e025da29a69effd42fe689876819ad90b159de8b32d64c96e
f5ce1abb61275e3402f49f48e8094bd2aa038f03845c41e2b7f570c66666794a
SH256 hash:
cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036
MD5 hash:
b2708893f54cd6e5d543827af3256657
SHA1 hash:
b009e448b2671ca8b4c143d42ab4170d187b45e3
Link:
https://www.unpac.me/results/95746390-979f-4001-a657-0f2a5ba70814/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe cf47e9aada511391561f8ebd2cc31b0aa3151d4fad118d57fe13bf4a5a15a036

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/173666/

Comments


Avatar
zbet commented on 2021-07-23 15:04:09 UTC

url : hxxp://grandfathertriangle.xyz/download/pl_installer.exe