MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93
SHA3-384 hash: 130271098ee5c0577cac1b25f389037bc9505ee47961c951c56a4f4af1ea772f236083f1a5d38492ac9dd16355c08f00
SHA1 hash: f0d39289981d00d64ddb76fa1bc273eca28b468c
MD5 hash: f7ace51c49bc40593b1c8e2fda11e2c6
humanhash: oscar-skylark-sweet-muppet
File name:f7ace51c49bc40593b1c8e2fda11e2c6.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:458'752 bytes
First seen:2021-11-14 03:06:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b2271179048a9a8fc6be7cfe8a9583d2 (10 x RaccoonStealer, 2 x Smoke Loader, 1 x DanaBot)
ssdeep 12288:LwmXoeS7XFMisiJ/sLaVyrjqh0J7j1UECaYULOw:k4S7Fmuia+jqGN1hYSO
Threatray 4'154 similar samples on MalwareBazaar
TLSH T168A402016BA4D4B6E59736312A30C7BD1B2BFC325835514A3BA52A3F2E737D04AB9317
File icon (PE):PE icon
dhash icon fcfcb4f4d4d4d8c8 (8 x RedLineStealer, 6 x RaccoonStealer, 4 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://185.163.47.175/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.163.47.175/ https://threatfox.abuse.ch/ioc/247972/

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205580/
Detection(s):
Win.Packed.Fragtor-9908420-0
Create hunting rule

Win.Packed.Fragtor-9908933-0
Create hunting rule

Win.Packed.Generic-9908949-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
DNS request
Sending a custom TCP request
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61907d593edf00a722d2fbf8/reports/b3ca80a4-0336-4bd9-a817-596e11d0ed19/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f181c897-006e-49c1-957c-b1db7c1b8d99
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888742
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-14 03:07:07 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7qcqxes7u52oo2xjae4ckbthvetunklkcnk7p45avac7d4c7sjq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
28f5fb04e33ee8f3257b1a2c6f4ade3f281b0d474eea4bdde2abe622a1b11994
RaccoonStealer
30fd5af8455df4fd2846b4460b13dfc13ca93b5b156196fc16f00dd739f8f418
RaccoonStealer
3e820217037e312b739d6514547da6a7afd3d9e3b92dc90e6c30c35808fb5214
RaccoonStealer
8dee7c9f5e45b520324d40a399ce69972385c7d2423068c4496ad7df03fdb977
RaccoonStealer
bd6bb975db60f223e5169901b94cb4a087e76422f799890fba9049b3b9b80fc3
RaccoonStealer
d09f1f4d1e5cf1ea2c2ffcf037bb2af20315e592f5c7f6d8692c1b60c2713927
RaccoonStealer
e26fe6535f9ec57538d49515fdf98b1a925fa26dd28040a96a5bc1c94a691975
RaccoonStealer
fe3d7939166e8e6ae965d66d98f6ee5583e535b575ba194aef038c6c1ea15ae4
RaccoonStealer
+ 4'144 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:6376eadae19f380741dabeeb94e58e106987305a stealer
Link:
https://tria.ge/reports/211114-dmbwescgfm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
c83476f50235327d4389669a687880ca9fb1741906d7c26425eb02ceb8e53617
MD5 hash:
c23378fe6c68d7af30536bdb086aa642
SHA1 hash:
87255138d7760f93689f8ece85be378c57442735
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/5877b7a8-c206-494f-ab94-1e6d97024945/
Parent samples :
f3437e96520f1bbe5ffc6e027915d40a7d86a94e94466d63e0f86a0bb18224e1
59f5b3b26ae37d44bc12ccb03292611a6074db6a1ec6675f77bac0153f4c1357
21b63b7388447bb43eb1824063119b558b59cf93ef07e5071ba2d213794ca28a
325a40d50434589e27368c440cf300413aeae8fba0044ff292182c6b82175ba7
2e5e0f3a0ef05f284db9ce55be116751f7a85a0193235619115bd3c166d9b352
b94b96eb7b544695666e1a4c743c5f948aa69e2a5e93bf65b62199e01a276834
6dfcb0213344348d16738cdfb03afb66eafd9e569a923d256608c2711be4d1dc
d895d7793b22c9d6fc66a55e71ad757362b22a21992524ef5683f016ddf684b7
0d694fadcddd12ee2faba5478b69ceb251b9eda82aeb392003526cd4145a28dc
976b30ed3b9f1a8f02bac54aac1876534fd55ee277ca288c972774f20051f055
cab23f63a0cd63cd22fab73efb4c31044c7cb72617a1154a7c47bfa867196c57
58177414ce7cded267953804df02097df17d2ca711c175bc9a1d9c0681cc3093
bec0b668154a19902c4c39606a18bf0aaf93d52f4922e77dd15d44ddf359d20a
dd342468231a6e7e5cd08f7003da4185736c258be4cd0ecd61ff119d664c6b9b
2ac90195f9c08180833d92f039cb9c607a13bc021971fbad767e8194d88099d6
30fd5af8455df4fd2846b4460b13dfc13ca93b5b156196fc16f00dd739f8f418
cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93
SH256 hash:
cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93
MD5 hash:
f7ace51c49bc40593b1c8e2fda11e2c6
SHA1 hash:
f0d39289981d00d64ddb76fa1bc273eca28b468c
Link:
https://www.unpac.me/results/5877b7a8-c206-494f-ab94-1e6d97024945/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cfe0285c92fd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:SystemBC_Config
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, decrypted config.
Rule name:SystemBC_Socks
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, Socks proxy version.
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.
Rule name:win_systembc_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.systembc.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205580/

Comments