MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
SHA3-384 hash: ed3666002b7b8024ca9c60e22470c453f82aad4e8088c173224dc8336575cdac627261926ba29c0876d051912efd8d53
SHA1 hash: a82f4a80f7f0849ecc021855fcbfbf3220982d06
MD5 hash: bde1dbafbe609f7da66db66356d8f9e3
humanhash: twenty-finch-spring-ohio
File name:bde1dbafbe609f7da66db66356d8f9e3
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:710'144 bytes
First seen:2021-11-10 05:00:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b1d7987a638c820f79c0e265e27eaa61 (4 x RedLineStealer, 4 x RaccoonStealer)
ssdeep 12288:frUIw9C3QOmmaTdHNF29u4+Boc7Ia3MNpLyYKTRmkCdIVunnn7s:QIVjmmaTdHNkcOc7Ia32Z1KNmNdDA
Threatray 4'115 similar samples on MalwareBazaar
TLSH T1B6E401F1B2999875D1A73E715865CAA04B37BC32E430A906F630774E1E73ACC96E431E
File icon (PE):PE icon
dhash icon fcfcb4f4d4d4d8c0 (19 x RedLineStealer, 16 x RaccoonStealer, 14 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/204599/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Spy.21580.21846.1343.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer glupteba packed
Link:
https://www.filescan.io/uploads/618b5210175442ca93aa23fe/reports/ec34c386-86b7-4972-9d95-279cc70ba120/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e50131d3-f49d-4cfe-a235-8531f40873ad
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/886465
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86/
Threat name:
Win32.Trojan.Krypter
Create hunting rule
Status:
Malicious
First seen:
2021-11-08 15:14:26 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2f623qv3k6ifzcbqr54sfcaqwh372kg7v7qhof7cws7q3dqbj6da._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0ee7876b55f958fc7ca68bad76a5560778873b11d3032988c3ccbf88218cbe87
RaccoonStealer
279e35fe6b36106e0423f55262f0a995413a37055f72eb360cf2c12a423a690a
RaccoonStealer
46e130de5d270cbb370fa222a1b3819bb5413d19aabb2d576dcdab524972bf0d
RaccoonStealer
88271b4249717df1f08acbbbda7adafc9d146706f5727ab5b347537f89942e1b
RaccoonStealer
88528d9c937298a60f831e75aa132d9d4034a69377d2b25b28b7a1624bb0c73b
RaccoonStealer
e8a6c88c1335a8d257be28f7fa1e84d6c6eb30a64ab99ce1bd640c10345e77cb
RaccoonStealer
+ 4'105 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:8dec62c1db2959619dca43e02fa46ad7bd606400 stealer
Link:
https://tria.ge/reports/211110-fnjzjagda6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
e82323179c6aa25296935c2c0bb2cccc31cbdd6a1e6d5d07cca7cb39ba0e8ecd
MD5 hash:
12c5a03c855eef802d4acc9a88de4b13
SHA1 hash:
9b3277b88cd96f680cf247f8d7dc5bfcc08a0ccb
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/d1c630ce-2089-481a-b6d0-7a8b2b65b3fa/
Parent samples :
e0ddefa2d8101c3602f8186aa02c5b770e928a162bc3483dc85f605a4e0d03a3
a6b03de6f9e8eadbd3ad94084b19fbed87a070ef21e2baf63c338790b2ae24e9
2b8b768eeffd26b5aee05c3e1d309c6c9f94a62d2ba8a230695305008cbfb985
8abe4bc33112ce5bc9ce4ef8b33187c33a537cf540a63eb9562b4a0622f634aa
d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SH256 hash:
2a250188ffe87fa64e93cccf3b197d89d6e5ab8ba8efea9a0149fc0a7f4d8fc3
MD5 hash:
b01767607a52909aec325b1a50853c3d
SHA1 hash:
87418f913d254ae822fb9a814b60db42e615cf60
Link:
https://www.unpac.me/results/d1c630ce-2089-481a-b6d0-7a8b2b65b3fa/
SH256 hash:
931f53712545be28c7d66cdec08103fe13cad80aaa689e898e87e26195905dd0
MD5 hash:
67ba6bb553fdeaa6b7a783c9f642e642
SHA1 hash:
51d05d93daff50ba168c3a2af312dc6810ad83d9
Link:
https://www.unpac.me/results/d1c630ce-2089-481a-b6d0-7a8b2b65b3fa/
SH256 hash:
d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
MD5 hash:
bde1dbafbe609f7da66db66356d8f9e3
SHA1 hash:
a82f4a80f7f0849ecc021855fcbfbf3220982d06
Link:
https://www.unpac.me/results/d1c630ce-2089-481a-b6d0-7a8b2b65b3fa/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d17dadc2bb57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1771495/
Cape
Cape
https://www.capesandbox.com/analysis/204599/

Comments


Avatar
zbet commented on 2021-11-10 05:00:55 UTC

url : hxxp://host-host-file6.com/files/7993_1636371023_9825.exe