MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd
SHA3-384 hash: 1b9ccfd75a662e5b80c01165c878c52e5556af7df051cac30fc2c5a999f5c87cbe34e1ab63a59d7a69233cb23e3db3fe
SHA1 hash: 0d09c84637f65a171551b2270d9d2aa076e33474
MD5 hash: 46abd8bb74346edeb4dd62386cc384c6
humanhash: saturn-wolfram-hot-moon
File name:46abd8bb74346edeb4dd62386cc384c6.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:591'360 bytes
First seen:2021-03-13 07:27:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c2408c4e289059dc1f7339d62dec625 (2 x RaccoonStealer, 1 x Formbook)
ssdeep 12288:2ej3tqAiHF+0wu2gxx7MnEYqoIPwkxlXgOYNTOyDHlJzLc:2kTiH80yy25qzwUlXYhD/f
Threatray 434 similar samples on MalwareBazaar
TLSH 60C4D010A7A0E034F4B676F84A798265A93D7D71DF2491CF72D62AEA26346F0EC30357
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
https://gogowormdealer.top/

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
46abd8bb74346edeb4dd62386cc384c6.exe
Verdict:
Malicious activity
Analysis date:
2021-03-13 07:28:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eff9cbdc-0c9b-4a06-8424-6d8d33d6db32

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/124036/
Detection(s):
Win.Packed.Tofsee-9840603-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Sending a custom TCP request
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/638454
Signature
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd/
Threat name:
Win32.Trojan.StellarStealer
Create hunting rule
Status:
Malicious
First seen:
2021-03-12 03:49:30 UTC
AV detection:
28 of 47 (59.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3egzgjwg6gqdngpvgxfpncwi3zypiopw2r3oyw74f6oqurxx3o6q._file
Verdict:
malicious
Similar samples:
194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2
RaccoonStealer
6ffcc15b0b38937381a1f43b30739091f07a8e6fbba05e94c5d973c1a0dbc5eb
RaccoonStealer
706a3b4438e7b883d8c3cd66ffabfbb3e3495b3b7c6f9b48adf7a5c8cdd0c3c1
RaccoonStealer
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
RaccoonStealer
a6e43031567484437341b50ea0c165ad416ffa629e2951a0e82844dcfb27e408
RaccoonStealer
bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac
RaccoonStealer
c394b83a255961adb3ec0c8e35b21e05ee432b3c758b25ceac7e3dc3a10486a7
RaccoonStealer
c84d7d17bace5f7ab474440491d7c3aa0be6fabbd5fab86106b10a45e4b97bfc
RaccoonStealer
d7420d82ddf1f14456c5c8fc3c1a4a128937bad4d34794dbe103aacc4a2aa699
RaccoonStealer
e51a5ecb5c7ab754cccf2531882b6e724dcd0b15a9c3978384480605549096c5
RaccoonStealer
+ 424 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:ddcbd6366de67d1cf1d10203593a074aab7abd55 stealer
Link:
https://tria.ge/reports/210313-arryyn3b4j/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
1aa47cb22e407892616618fe2adc633a245d5dc022bf0f105cc0b7a67a9d6f6a
MD5 hash:
72f6d2ff36798c266ddb0b3755dec951
SHA1 hash:
ce30345693180d024b301dfd0f527343453f30a1
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/f4c8cd04-9c7f-4684-abec-99eb0a172e3d/
Parent samples :
1780d38ef73129177134042720cfc526fe012760f406e9e030d8d5fbbdfb7828
a2a7e43ce1a853842ecb2bdb665b180119d539d56ce2c2eab1a54d098cc92edd
71599788e1da3359b99ada8c3b84b96a9741c1f68550c09b0345d979cdc4b8a6
c84d7d17bace5f7ab474440491d7c3aa0be6fabbd5fab86106b10a45e4b97bfc
194b0807d3cc0922a3d218b1628cf78c8bc01ba3e03446d1cf123469ffe045e2
a3280da75d606d54a450b69372eca59b6f5f3a934e461c68b4d2e38f6223046e
66496b0a09ac29095bc092f123a6ce7362ba199fccc1906f27c956312eca9c8c
106c0169d2464a9efe9ee45c1e7c5863764e6d9fca3809bb249bbb97d3cf3086
c394b83a255961adb3ec0c8e35b21e05ee432b3c758b25ceac7e3dc3a10486a7
bcc49344ddab6a3271480eafb423ee292ed4b2d32792f1b79ed72db0ad856665
bd3cb9af2d60dee1db0489faf8a7e4bec8a5be8194e53e79371b110440317cac
c3086a0de5d4e484f06761da212260a38573239d3baaf6cf2c720e8315d17e0e
d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd
SH256 hash:
d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd
MD5 hash:
46abd8bb74346edeb4dd62386cc384c6
SHA1 hash:
0d09c84637f65a171551b2270d9d2aa076e33474
Link:
https://www.unpac.me/results/f4c8cd04-9c7f-4684-abec-99eb0a172e3d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe d90d9326c6f1a03699f535caf68ac8de70f439f6d476ec5bfc2f9d0a46f7dbbd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1054507/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124036/

Comments