MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e
SHA3-384 hash: cc4947c5251a3617feb0784a453e860231b9871f0e40bc0df6fa3f136e9473206ee25f68739ff220e2835173ad411211
SHA1 hash: 49252eae3983eaa89eea12b5f5b65c5e147d3e5b
MD5 hash: df81d775612d1565e5564d416420c2fd
humanhash: island-iowa-hamper-ohio
File name:df81d775612d1565e5564d416420c2fd.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'028'096 bytes
First seen:2021-02-16 16:05:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5fafce47e59448c4a3ba51806e4255f1 (2 x RaccoonStealer, 1 x RemcosRAT)
ssdeep 24576:iGVJLVwfsOmo3MYYFhSHOEIk3XWT9JZH9h:X433nYpEIkonZH9h
Threatray 471 similar samples on MalwareBazaar
TLSH EA25F117BA274853F0550A718AD396F46B3EAD43B9822F0FEB447E1C5DB13826CE1276
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117384/
Detection(s):
Win.Malware.Babar-9831045-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Sending a custom TCP request
Creating a file
Sending an HTTP POST request
Connection attempt
Deleting a recently created file
Reading critical registry keys
Replacing files
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Threat name:
AsyncRAT Azorult Raccoon Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/609215
Signature
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AsyncRAT
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 353636 Sample: mDxyEfHSMs.exe Startdate: 16/02/2021 Architecture: WINDOWS Score: 100 109 icacxndo.ac.ug 2->109 111 brudfascaqezd.ac.ug 2->111 113 2 other IPs or domains 2->113 125 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->125 127 Multi AV Scanner detection for domain / URL 2->127 129 Found malware configuration 2->129 131 18 other signatures 2->131 10 mDxyEfHSMs.exe 16 2->10         started        signatures3 process4 file5 101 C:\Users\user\AppData\...\bvnhjgDSvbc.exe, PE32 10->101 dropped 103 C:\Users\user\AppData\...\FDdfhgtyrgfb.exe, PE32 10->103 dropped 151 Detected unpacking (changes PE section rights) 10->151 153 Detected unpacking (overwrites its own PE header) 10->153 155 Maps a DLL or memory area into another process 10->155 14 bvnhjgDSvbc.exe 4 10->14         started        17 mDxyEfHSMs.exe 87 10->17         started        21 FDdfhgtyrgfb.exe 4 10->21         started        signatures6 process7 dnsIp8 157 Detected unpacking (changes PE section rights) 14->157 159 Maps a DLL or memory area into another process 14->159 23 bvnhjgDSvbc.exe 71 14->23         started        105 againstpolicebrutality.top 104.21.89.29, 443, 49730 CLOUDFLARENETUS United States 17->105 107 tttttt.me 95.216.186.40, 443, 49721 HETZNER-ASDE Germany 17->107 73 C:\Users\user\AppData\...\vFk2e9Wefn.exe, PE32 17->73 dropped 75 C:\Users\user\AppData\...\npNyDl8pub.exe, PE32 17->75 dropped 77 C:\Users\user\AppData\...\eLdaP0lDYZ.exe, PE32 17->77 dropped 79 60 other files (none is malicious) 17->79 dropped 161 Tries to steal Mail credentials (via file access) 17->161 28 vFk2e9Wefn.exe 17->28         started        30 npNyDl8pub.exe 17->30         started        32 54EUJUjlyG.exe 17->32         started        36 2 other processes 17->36 163 Detected unpacking (overwrites its own PE header) 21->163 34 FDdfhgtyrgfb.exe 188 21->34         started        file9 signatures10 process11 dnsIp12 119 taurus.ug 23->119 83 C:\Users\user\AppData\Local\Temp\rc.exe, PE32 23->83 dropped 85 C:\Users\user\AppData\Local\Temp\ds1.exe, PE32 23->85 dropped 87 C:\Users\user\AppData\Local\Temp\ac.exe, PE32 23->87 dropped 97 49 other files (none is malicious) 23->97 dropped 137 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->137 139 Tries to steal Instant Messenger accounts or passwords 23->139 141 Tries to steal Mail credentials (via file access) 23->141 149 3 other signatures 23->149 38 rc.exe 23->38         started        42 ds1.exe 23->42         started        44 ac.exe 23->44         started        53 2 other processes 23->53 121 cdn.discordapp.com 162.159.130.233 CLOUDFLARENETUS United States 28->121 89 C:\Users\Public\Libraries\Oqptnest.exe, PE32 28->89 dropped 143 Creates a thread in another existing process (thread injection) 28->143 145 Injects a PE file into a foreign processes 28->145 91 C:\Users\user\AppData\Local\...\tmpC606.tmp, XML 30->91 dropped 93 C:\Users\user\AppData\Roaming\RSIdQVc.exe, PE32 30->93 dropped 46 schtasks.exe 30->46         started        55 2 other processes 32->55 123 hanxlas.ac.ug 185.215.113.77, 49722, 49723, 49732 WHOLESALECONNECTIONSNL Portugal 34->123 95 C:\ProgramData\vcruntime140.dll, PE32 34->95 dropped 99 6 other files (none is malicious) 34->99 dropped 147 Tries to steal Crypto Currency Wallets 34->147 48 cmd.exe 34->48         started        50 eLdaP0lDYZ.exe 36->50         started        57 2 other processes 36->57 file13 signatures14 process15 dnsIp16 115 162.159.134.233 CLOUDFLARENETUS United States 38->115 117 cdn.discordapp.com 38->117 133 Creates a thread in another existing process (thread injection) 38->133 135 Injects a PE file into a foreign processes 38->135 59 ds1.exe 42->59         started        61 conhost.exe 46->61         started        63 conhost.exe 48->63         started        65 taskkill.exe 48->65         started        81 C:\Windows\Temp\reo0dndv.exe, PE32 50->81 dropped 67 conhost.exe 53->67         started        69 timeout.exe 53->69         started        71 powershell.exe 55->71         started        file17 signatures18 process19
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e/
Threat name:
Win32.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 11:48:57 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3gh5qgesopspj7f3rmovwmsftnoxvxgw5l7z57xqymvm4d67vmha._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
16e587a78c6af7a68db2eee80ac40ccec784aeb261cfa7bab04c54608dc96324
RaccoonStealer
17e1ef78f68371282d030616c47734fa831864cac7fc0ed3171cdc0087bcc894
RaccoonStealer
483c603c9fb09c2e908d782f7e6f3f04e6e26b7eaaf8ac637733a4e4a32c80e7
RaccoonStealer
4a3dbd9e76bdf61687afb04313b2cd9682985f1c55c62f54d9f39442c538bae4
RaccoonStealer
61198dcb525d78061585053ddc30e99ca70842899622e333eb64d3b68ee7a167
RaccoonStealer
b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
RaccoonStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
RaccoonStealer
c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
RaccoonStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
RaccoonStealer
d2c1530870532abdf2123652c9f97dc9de79dc8aabbb8cfd185b1011d6cdbb01
RaccoonStealer
+ 461 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:azorult family:oski family:raccoon botnet:8e94b823a9991735de58978b0e8609a618f8ddd3 discovery evasion infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/210216-rg7x6jnwre/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Async RAT payload
AsyncRat
Azorult
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
Oski
Raccoon
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
icando.ug:6970
icacxndo.ac.ug:6970
Unpacked files
SH256 hash:
08cbbbdbc6b201eb609be7d4d00761f127de3cd5e506f55dc3ee3acb4032d9c3
MD5 hash:
8f8a0367aae0a55c42783c81c08d46ab
SHA1 hash:
e60233116884c925fd3eabe952ff958abc239d8a
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/b5c55cce-a63a-4755-a55d-6f94f9a00108/
SH256 hash:
c343b73510f93b40f267d681288aab3865f080cfc6a6ad61602ad084faaeab00
MD5 hash:
f42ae12295d6dd4f4f55dfd576fdddf1
SHA1 hash:
cf48ca19ea73fe0669d179d79bdd074f319c83a2
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/b5c55cce-a63a-4755-a55d-6f94f9a00108/
SH256 hash:
eac389ce0a373f81e1690dd4e84c7a4f7786e80c9bb30295b9d08ed0045c0bf4
MD5 hash:
0607c0aeb9e5ddaf15c23d9aa6653ff2
SHA1 hash:
0f1622770f601c40c74c311a3fca4c28266c49ad
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/b5c55cce-a63a-4755-a55d-6f94f9a00108/
SH256 hash:
d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e
MD5 hash:
df81d775612d1565e5564d416420c2fd
SHA1 hash:
49252eae3983eaa89eea12b5f5b65c5e147d3e5b
Link:
https://www.unpac.me/results/b5c55cce-a63a-4755-a55d-6f94f9a00108/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon/Racealer infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar infostealer variants
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/791257/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
  
URLhaus
https://urlhaus.abuse.ch/url/615226/
Cape
Cape
https://www.capesandbox.com/analysis/117384/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/791302/
  
URLhaus
https://urlhaus.abuse.ch/url/584190/
  
URLhaus
https://urlhaus.abuse.ch/url/836469/

Comments