MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 11
| SHA256 hash: | d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45 |
|---|---|
| SHA3-384 hash: | 72de97d4b7a5a4069df3fc8cdc877b42704400cf3978aac51bbae23ae63692b9520cfbce393ddf05ec9f059259e897a9 |
| SHA1 hash: | c66fcba85d3d490ee3c6db6ca01157bef4ea6c7c |
| MD5 hash: | 6fa7f8fb04d2bff1ea40fc7ab0e48452 |
| humanhash: | ink-zulu-sad-seventeen |
| File name: | 6fa7f8fb04d2bff1ea40fc7ab0e48452.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 497'152 bytes |
| First seen: | 2021-09-21 11:55:45 UTC |
| Last seen: | 2021-09-21 13:16:57 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b4a5f131bf57e0871ab3cda52113b279 (4 x RedLineStealer, 2 x RaccoonStealer, 2 x Stop) |
| ssdeep | 12288:WMHY8bmRmJWEYbOLquUJWB4z3vuV2qxAxBai:pRbkm/YbOFZBQvudmxh |
| Threatray | 3'203 similar samples on MalwareBazaar |
| TLSH | T170B401003670C531D5A79270CF74E794ABEAF85154B4874B7BA22F6EEF30381772A25A |
| File icon (PE): |  |
| dhash icon | 327e7c7f727e6e76 (3 x RaccoonStealer, 2 x Stop, 1 x Tofsee) |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://185.53.46.105/ | https://threatfox.abuse.ch/ioc/224184/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6fa7f8fb04d2bff1ea40fc7ab0e48452.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 11:58:58 UTC
Tags:
trojan stealer raccoon loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Malware family:
Raccoon Stealer
Verdict:
Malicious
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Detection:
raccoon
Threat name:
Win32.Trojan.Zenpak
Status:
Malicious
First seen:
2021-09-21 11:56:06 UTC
AV detection:
16 of 45 (35.56%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
raccoon
Similar samples:
+ 3'193 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon discovery spyware stealer
Behaviour
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Unpacked files
SH256 hash:
2b846276cddcb96a51df3052f4f63232f4a9615e08df959342185ed0255c3f0c
MD5 hash:
6f5936f1ebe731d1069daa1b20473a6f
SHA1 hash:
e83bd74f6ebb2b095cffb5f534c3ad1d0017c7c3
Detections:
win_raccoon_auto
Parent samples :
d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768
39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7
7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332
77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a
f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb
d720677c3d1ae4e2048fba7ff9a80839affa35f45f6abd2643b0de4a0f9bc997
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768
39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7
7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332
77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a
f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb
d720677c3d1ae4e2048fba7ff9a80839affa35f45f6abd2643b0de4a0f9bc997
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244
SH256 hash:
d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45
MD5 hash:
6fa7f8fb04d2bff1ea40fc7ab0e48452
SHA1 hash:
c66fcba85d3d490ee3c6db6ca01157bef4ea6c7c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.