MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01
SHA3-384 hash: 4467fe3f2e5e6d09f3186a0713b098da6d5d2e072180b9e54ca6da7ffc13c8c8f030728b8d85c1ea886faf15b76fb8bc
SHA1 hash: 18dbef336c70b6fbe50926602b3305299c258848
MD5 hash: 11d57daf30ca3e02d82760025034d970
humanhash: sink-king-papa-xray
File name:11d57daf30ca3e02d82760025034d970.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:198'656 bytes
First seen:2021-08-16 14:35:04 UTC
Last seen:2021-08-16 15:52:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1a43dad8615b89dc6e5d071c17cc8026 (2 x RaccoonStealer, 1 x Smoke Loader, 1 x DanaBot)
ssdeep 3072:jlDLCW+ruTAtvPER2/dJOsBNBNRmQuKT0yB3rrihFdoYWk:FLEAAR8R2/dJOkFli8
Threatray 5'316 similar samples on MalwareBazaar
TLSH T1B114CF107590E672C49241348891FFEC9EA9FDB0EE60422B7B987A5F5F703E0666734E
dhash icon 10367878727e7e36 (4 x Smoke Loader, 3 x RedLineStealer, 2 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
11d57daf30ca3e02d82760025034d970.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-16 14:41:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/99eb3ce5-80e9-40ef-aa79-913186b25442

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179561/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.14153.7896.14413.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Connection attempt to an infection source
Sending a UDP request
Creating a process from a recently created file
Unauthorized injection to a recently created process
Query of malicious DNS domain
Unauthorized injection to a recently created process by context flags manipulation
Deleting of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bbf48387-1646-4390-8035-505c5542bb11
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833585
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to resolve many domain names, but no domain seems valid
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 466016 Sample: vkJxStDZo6.exe Startdate: 16/08/2021 Architecture: WINDOWS Score: 100 32 Multi AV Scanner detection for domain / URL 2->32 34 Found malware configuration 2->34 36 Antivirus detection for URL or domain 2->36 38 6 other signatures 2->38 7 vkJxStDZo6.exe 2->7         started        10 wufergg 2->10         started        process3 signatures4 50 Detected unpacking (changes PE section rights) 7->50 52 Contains functionality to inject code into remote processes 7->52 54 Injects a PE file into a foreign processes 7->54 12 vkJxStDZo6.exe 7->12         started        56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 15 wufergg 10->15         started        process5 signatures6 60 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 12->60 62 Maps a DLL or memory area into another process 12->62 64 Checks if the current machine is a virtual machine (disk enumeration) 12->64 17 explorer.exe 2 12->17 injected 66 Creates a thread in another existing process (thread injection) 15->66 process7 dnsIp8 26 readinglistforjuly1.xyz 146.185.239.6, 49754, 80 PINDC-ASRU Russian Federation 17->26 28 readinglistforjuly9.club 17->28 30 30 other IPs or domains 17->30 22 C:\Users\user\AppData\Roaming\wufergg, PE32 17->22 dropped 24 C:\Users\user\...\wufergg:Zone.Identifier, ASCII 17->24 dropped 40 System process connects to network (likely due to code injection or exploit) 17->40 42 Benign windows process drops PE files 17->42 44 Performs DNS queries to domains with low reputation 17->44 48 2 other signatures 17->48 file9 46 Tries to resolve many domain names, but no domain seems valid 28->46 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01/
Threat name:
Win32.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 10:04:32 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mb4ysirtm7spoiezqg4c2f3dsgpixeinfo7xscquwkylfrfvqaq._file
Verdict:
suspicious
Similar samples:
0ef8e97b174862177771e0f42373530de7356883781cd0c498ac950dd2748835
RaccoonStealer
1a471836c805bbee8b08512c7a813aa00c5df6dcb11888d39bf652afb7ab36f6
RaccoonStealer
28b577b09ddd23494aaa0a19ae4e9219562a80a9176b9cfcdd3bb76a59bf4a28
RaccoonStealer
39894026621d1c5fabeca0fe3b0ba3fe2e97d99e17d50227ead4ac7c64ee080c
RaccoonStealer
4aa5d31d20f0fd1c34a98270119339269fb7be574e580d7a21da7ecb3a59f471
RaccoonStealer
5ec0c20ecf87a05f81cbf45da37943f2f2ebfead783364ff89dd843a2fcde08b
RaccoonStealer
663d11c6a687961e8b5cda09b720a9511d972a9ea164cf8c385037a33eea53fa
RaccoonStealer
d1195982518ce6cf57fb9926ff08920a54ac3ada4fa1d559e70b3410f4d62bd9
RaccoonStealer
fc2d4be12648dae97df783706ec9fea8396d3327428fa73b44e2968fbd7d3e8b
RaccoonStealer
fdacbb575b9ae8cba7286e562abd4d3547089e0ea17b4885b3a4a738b83831fb
RaccoonStealer
+ 5'306 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor suricata trojan
Link:
https://tria.ge/reports/210816-7p5ckce3vs/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
SmokeLoader
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
Malware Config
C2 Extraction:
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Unpacked files
SH256 hash:
8b085611ecc9d6df0bc54d8421e57eb82f70c2c085e488ccfb41b4d26560bc57
MD5 hash:
3dff4690ed57aba1cd05faf0e7d2ec18
SHA1 hash:
feda1fc6459b5391f3a56da56d9da8089944df5b
Link:
https://www.unpac.me/results/cc19b913-62c4-4944-8a2a-b9b1afc2475c/
SH256 hash:
d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01
MD5 hash:
11d57daf30ca3e02d82760025034d970
SHA1 hash:
18dbef336c70b6fbe50926602b3305299c258848
Link:
https://www.unpac.me/results/cc19b913-62c4-4944-8a2a-b9b1afc2475c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d303cc49119b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe d303cc49119b3f27b904cc0dc168bb1c8cf45c88695dfbc850a595859625ac01

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/179561/
  
URLhaus
https://urlhaus.abuse.ch/url/1532714/
  
Delivery method
Distributed via web download

Comments