MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0b916f3be7c1e77a5bd6865623b7c75fea0eae73526c2b314bae799dbbb09e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	d0b916f3be7c1e77a5bd6865623b7c75fea0eae73526c2b314bae799dbbb09e2
SHA3-384 hash:	8b3671973529e8367c2c61ec0d073d9d97e4d90cfbed5798c8c80f91c15ff1ac06526baf23ac75cc606b2cdedc4bda32
SHA1 hash:	cfdcde554f565d279fee248b52f4c5d3123be89a
MD5 hash:	4bcedd0a9136912cff2745a313581ba6
humanhash:	coffee-finch-delaware-hawaii
File name:	SecuriteInfo.com.BehavesLike.Win32.VBObfus.gc.25959
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	410'624 bytes
First seen:	2020-05-20 17:45:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	964c5fc9740e4f22caf984a7542ad2ae (1 x RaccoonStealer, 1 x TrickBot)
ssdeep	12288:5l/P2SmBgHB8+OP6fcKj398uIj2mnJiJzcAYljMha:r32Smu6+pEKjN8SmnIJzulAa
Threatray	157 similar samples on MalwareBazaar
TLSH	43941221F7E1C23EC36259718C10B485D6B6B89227365B9723E22B1A9E713D51A7730F
Reporter	SecuriteInfoCom
Tags:	RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.VBObfus.gc.25959.UNOFFICIAL

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Cridex

Status:

Malicious

First seen:

2020-05-20 15:52:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2c4rn456pqphpjn5nbsweo34ox7kb2xhgutmfmyuxltztw53bhra._file

Verdict:

malicious

RaccoonStealer

1f41788769bed2b7fa9f0d52c257b57eaf17793d6e02d5b4aea4a4a148d72874

RaccoonStealer

2b54fb9596441cbdb7f2208b41a717adba83c5834a49c534f54d479131f750c1

RaccoonStealer

4aedc1ecfe84e885ec6021198dbb729f438f9f058fb2363a09512cecf776c975

RaccoonStealer

61c47bc44d3877e815be609e98f97eb1b79ee1c9215646570d85cc40aa9c1317

RaccoonStealer

beb2824122982ae356642d0d46c7fba54424687558a35df7e0b22263f9587332

RaccoonStealer

d54f78713ce9ccaaf5b87be9e0273061eb659c547d5882332642b20d71547f79

RaccoonStealer

e6d287e8934bea3f8c237e9095cfebd7e629bb2a9624eafc0b26065e0e03485f

RaccoonStealer

e9ba77b36bd2ca8d3c4486930e2e79d670804bdbec171b8a459c4d1264d7c100

RaccoonStealer

ee9634a80a4ae316b85a7178f0cfd96bf288ae5f8f73d86945b10d4f7addcf14

RaccoonStealer

+ 147 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-6gr9mse31a/

Behaviour

Modifies system certificate store

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator