MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
SHA3-384 hash: ac14848b8085af664de4d3855a9475e3fa418716c11484d686f8e35cdddc8bbf4c85377c511a31095372e204e5ab4686
SHA1 hash: a5314eb3853a8f07e89d7d6cac031323ebaecdf1
MD5 hash: ae55d47a050f60be3b3cc00ea8575bc6
humanhash: snake-mars-montana-march
File name:d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:445'440 bytes
First seen:2020-11-11 10:53:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash df2b551a37fdd33960d531ea2b7b4df3 (4 x RaccoonStealer)
ssdeep 12288:QCVhif2ybAlbf1MT8WPWBdGtROAV64qKs7KnJKjzaLQAe:lsYlbVWPydGtROAV64IKIzO
Threatray 185 similar samples on MalwareBazaar
TLSH 3D940194BB72CC31C0A352713DB8E7724A2B7873977858C7EA4427686DA01E19EB7307
Reporter seifreed
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Glupteba-9622151-0
Create hunting rule

Win.Dropper.Glupteba-9622152-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 10:54:38 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=24x76pt5ujixyjh4w2xnd7qlmaxsqnbbbew5i4f6rtxelcvg23qa._file
Verdict:
malicious
Similar samples:
01409a8c1a4815214036cdac1796e2a6b680f7149b2117346a1f01b809a18754
RaccoonStealer
13f9aaf463af2f611a36afe435ba5f3518f4583ce0b2d6e2a493a6f89c961e53
RaccoonStealer
1f057ca53fc065ca47ae62409af791cdd7c422a1080a4e4f7985987725ab9350
RaccoonStealer
2c0fc1518735d0f354fbed168c2f96d51cfa0e0ebf2dac3f7179a0b5b462e5a9
RaccoonStealer
31b85fde884193b976d6cae2209bd2c95f13d6de5d0ff4206612a8768a0c65d6
RaccoonStealer
501ebf8f394a5c9ce011f60d06fd27e948e40df690c1542903220f5800f19a2c
RaccoonStealer
5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e
RaccoonStealer
885345d6e648c3ed211fcd7f23a0a4207b8f8f90226cf2dbd8325e8ec8e2ae80
RaccoonStealer
beb2824122982ae356642d0d46c7fba54424687558a35df7e0b22263f9587332
RaccoonStealer
ca4f7d501b768375a9d3f839eb87a1c824f1c9dfdef9f8863332318523ba652a
RaccoonStealer
+ 175 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon stealer
Link:
https://tria.ge/reports/201111-a71f4m4ace/
Behaviour
Modifies system certificate store
Raccoon
Unpacked files
SH256 hash:
d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
MD5 hash:
ae55d47a050f60be3b3cc00ea8575bc6
SHA1 hash:
a5314eb3853a8f07e89d7d6cac031323ebaecdf1
Link:
https://www.unpac.me/results/df7aaab9-0f7d-4315-8914-8b591f85ef9d/
SH256 hash:
e65a98cc3f097bb413dddc734b1d96dfbd0344d9788685697e44007543d0eb61
MD5 hash:
16637848d7db10d94284716ad4ca3169
SHA1 hash:
aa17325c0f2f8e29ca4c0c1e0d729ee6e181fff5
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/df7aaab9-0f7d-4315-8914-8b591f85ef9d/
Parent samples :
d72fff3e7da2517c24fcb6aed1fe0b602f283421092dd470be8cee458aa6d6e0
18037c34b9aafe45a8cd0743c637eac4abc50cfd6b14bd678bac6620ade45401
296a0bcb843e46c337e076b77cbc6395abccf232632c0ff67c5bbdde5ba5031e
acf98cf2d63bf2e47b47e1bc5ea4985e01baf6f43cc3a01de2ca71d66d8706fb
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments