MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d78277798307b83a9a1c0d695abec585b290fe1fe69556f62e6bec7e1ba37e26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 12
| SHA256 hash: | d78277798307b83a9a1c0d695abec585b290fe1fe69556f62e6bec7e1ba37e26 |
|---|---|
| SHA3-384 hash: | 9a58b122869a4712dd91b7ded4e3d8565fc2055bd56790110bcaeab2125e96fedcc64fd3ba03f89c9ead51542b6e799c |
| SHA1 hash: | 2ee687a8a209ff7dfa7dc7687becc43994593f3c |
| MD5 hash: | c930e58b8e73139d86ad40ccb9b8b19e |
| humanhash: | high-fish-bacon-earth |
| File name: | skinny_Setup.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 4'472'832 bytes |
| First seen: | 2023-01-06 11:57:47 UTC |
| Last seen: | 2023-01-06 13:30:22 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat) |
| ssdeep | 98304:uSk6F51U6HNesMycfbbEHv0mrSCcBT7h58oql8V6QYOaBBQY:LkiXRN8KS8oqlXB+ |
| TLSH | T12E26333DF2D1828DD82CEB715371845F08AF9D8B4DF03B68F64138F9C936AA7859644A |
| TrID | 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  jomphatt |
| Tags: | exe RaccoonStealer |
jomphatt
Since the original file is 300+ MB in size, I failed to upload it here. So, I followed the technique described in https://forensicitguy.github.io/pecheck-malware-weight-loss/ to remove null bytes, so its size was reduced.Original Filename: Setup.exe
Original SHA1: b3c11e7420f3e0ba1a0d84d575dc3154410cc805
Intelligence
File Origin
# of uploads :
2
# of downloads :
224
Origin country :
THVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
skinny_Setup.exe
Verdict:
Malicious activity
Analysis date:
2023-01-06 11:59:19 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for analyzing tools
Searching for the window
Creating a file
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Verdict:
Malicious
Result
Threat name:
Raccoon Stealer v2
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
DLL side loading technique detected
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Babar
Status:
Malicious
First seen:
2023-01-06 11:58:09 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
16 of 26 (61.54%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
raccoon
Result
Malware family:
n/a
Score:
9/10
Tags:
bootkit evasion persistence trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Checks computer location settings
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
86ffd39f8c53924a25935a4e1667487c2a63c7c8313e4d4f6bb13a9ac742db3b
MD5 hash:
021ec3cc05e073e136aa1d19e199b77c
SHA1 hash:
f386c2997fd05878ee3bb9638550deed6e2cf296
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
SH256 hash:
bb97a591ec3febd91ad40f619f87a57781031c07dc95065aa26165567713d87f
MD5 hash:
a654909d3ebe7390a7c5a746ecae93b5
SHA1 hash:
86e2fb06d0f65ca008348b2753bc393fee6ae19e
SH256 hash:
53b8dcdfed2e9a4033e539a403e61666eb01f7c071f8002a8cf1ddaffbcea58e
MD5 hash:
0dceec82cf606b2304298161b444b227
SHA1 hash:
6ea27d5e9b33a5d5928e65ad28d717b5a72d8663
SH256 hash:
d78277798307b83a9a1c0d695abec585b290fe1fe69556f62e6bec7e1ba37e26
MD5 hash:
c930e58b8e73139d86ad40ccb9b8b19e
SHA1 hash:
2ee687a8a209ff7dfa7dc7687becc43994593f3c
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.