MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2
SHA3-384 hash: 8df4f46b52a85012360a2aed18c1ba1f1ac8d9a84ebc6f51b5ce8b0f5efef4aeb87a8293d8df2c7de25c5f0a0d169f18
SHA1 hash: 7a4f99fa0a75a6ddcab1901de445b3b2f4ea3267
MD5 hash: 207bb33577d0f8f3831a45858138d96b
humanhash: friend-bravo-rugby-london
File name:207bb33577d0f8f3831a45858138d96b.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:252'928 bytes
First seen:2021-09-07 04:36:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2b61ec335a437915fc26e9e5178da86 (5 x RaccoonStealer, 4 x Stop, 2 x ArkeiStealer)
ssdeep 3072:JhpA5zpFOCUTikVE/SdJmG8NYaVgrxPNF7IxSFqptSXtmlb1hCTkMJVWPrai:JhYpFO6k1XmG8OaG4tlZC46YP
Threatray 1'837 similar samples on MalwareBazaar
TLSH T1C2348D20B6A0C035F5F712F459B983AC6D3ABDB1AF2450CB62D42BEE5A346E49C30757
dhash icon 68e8e8e8aa62a499 (8 x RedLineStealer, 7 x RaccoonStealer, 3 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://45.142.215.237/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.142.215.237/ https://threatfox.abuse.ch/ioc/216755/

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
207bb33577d0f8f3831a45858138d96b.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-07 04:41:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6f3f53eb-b2fc-4494-b1af-8d2cbc70840f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185790/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader42.32996.8951.13101.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Moving a file to the Windows subdirectory
Launching a process
Connection attempt to an infection source
Creating a service
Creating a file
Launching a service
Launching the process to change the firewall settings
Deleting a recently created file
Reading critical registry keys
Sending a custom TCP request
Creating a file in the Windows subdirectories
Searching for analyzing tools
Searching for the window
Delayed reading of the file
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun for a service
Stealing user critical data
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a system process
Adding exclusions to Windows Defender
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d91de0df-e43f-4297-95ae-03c2767899fa
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee Xmrig
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/846227
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Creates files in alternative data streams (ADS)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Send many emails (e-Mail Spam)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to resolve many domain names, but no domain seems valid
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 478658 Sample: KlErfuBsH2.exe Startdate: 07/09/2021 Architecture: WINDOWS Score: 100 101 google.com 2->101 103 dns.google 2->103 105 140 other IPs or domains 2->105 133 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->133 135 Multi AV Scanner detection for domain / URL 2->135 137 Malicious sample detected (through community Yara rule) 2->137 145 22 other signatures 2->145 11 KlErfuBsH2.exe 2->11         started        14 zcvdbdlv.exe 2->14         started        16 fdhfgui 2->16         started        18 12 other processes 2->18 signatures3 139 Tries to resolve many domain names, but no domain seems valid 101->139 141 System process connects to network (likely due to code injection or exploit) 103->141 143 Performs DNS queries to domains with low reputation 103->143 process4 dnsIp5 181 Detected unpacking (changes PE section rights) 11->181 183 Contains functionality to inject code into remote processes 11->183 185 Injects a PE file into a foreign processes 11->185 21 KlErfuBsH2.exe 11->21         started        187 Writes to foreign memory regions 14->187 189 Allocates memory in foreign processes 14->189 24 svchost.exe 14->24         started        191 Multi AV Scanner detection for dropped file 16->191 193 Machine Learning detection for dropped file 16->193 28 fdhfgui 16->28         started        107 127.0.0.1 unknown unknown 18->107 109 192.168.2.1 unknown unknown 18->109 111 urydiahadyss16.club 18->111 195 Changes security center settings (notifications, updates, antivirus, firewall) 18->195 30 WerFault.exe 18->30         started        signatures6 process7 dnsIp8 147 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->147 149 Maps a DLL or memory area into another process 21->149 151 Checks if the current machine is a virtual machine (disk enumeration) 21->151 32 explorer.exe 19 21->32 injected 113 www.google.com 24->113 115 svitonline.com 24->115 117 86 other IPs or domains 24->117 93 C:\Windows\SysWOW64\...\systemprofile:.repos, DOS 24->93 dropped 153 System process connects to network (likely due to code injection or exploit) 24->153 155 Creates files in alternative data streams (ADS) 24->155 157 Injects a PE file into a foreign processes 24->157 159 Creates a thread in another existing process (thread injection) 28->159 file9 signatures10 process11 dnsIp12 95 ximusokall14.site 32->95 97 xandelissane2.xyz 32->97 99 22 other IPs or domains 32->99 79 C:\Users\user\AppData\Roaming\fdhfgui, PE32 32->79 dropped 81 C:\Users\user\AppData\Local\Temp\BC1.exe, PE32 32->81 dropped 83 C:\Users\user\AppData\Local\Temp\67B6.exe, PE32 32->83 dropped 85 7 other malicious files 32->85 dropped 123 System process connects to network (likely due to code injection or exploit) 32->123 125 Benign windows process drops PE files 32->125 127 Performs DNS queries to domains with low reputation 32->127 131 2 other signatures 32->131 37 67B6.exe 32->37         started        40 2A2C.exe 2 32->40         started        43 5110.exe 32->43         started        45 6 other processes 32->45 file13 129 Tries to resolve many domain names, but no domain seems valid 97->129 signatures14 process15 dnsIp16 161 Multi AV Scanner detection for dropped file 37->161 163 Detected unpacking (changes PE section rights) 37->163 165 Query firmware table information (likely to detect VMs) 37->165 167 Tries to detect sandboxes and other dynamic analysis tools (window names) 37->167 48 conhost.exe 37->48         started        89 C:\Users\user\AppData\Local\...\zcvdbdlv.exe, PE32 40->89 dropped 169 Machine Learning detection for dropped file 40->169 171 Uses netsh to modify the Windows network and firewall settings 40->171 173 Modifies the windows firewall 40->173 50 cmd.exe 40->50         started        53 cmd.exe 40->53         started        55 sc.exe 40->55         started        63 3 other processes 40->63 175 Hides threads from debuggers 43->175 177 Tries to detect sandboxes / dynamic malware analysis system (registry check) 43->177 57 conhost.exe 43->57         started        119 185.167.97.37 CLOUDWEBMANAGE-EUGB Netherlands 45->119 121 cdn.discordapp.com 162.159.135.233 CLOUDFLARENETUS United States 45->121 91 C:\Users\user\AppData\...\LEDKeeper2.exe, PE32+ 45->91 dropped 179 Contains functionality to steal Internet Explorer form passwords 45->179 59 conhost.exe 45->59         started        61 conhost.exe 45->61         started        65 2 other processes 45->65 file17 signatures18 process19 file20 87 C:\Windows\SysWOW64\...\zcvdbdlv.exe (copy), PE32 50->87 dropped 67 conhost.exe 50->67         started        69 conhost.exe 53->69         started        71 conhost.exe 55->71         started        73 conhost.exe 63->73         started        75 conhost.exe 63->75         started        77 conhost.exe 63->77         started        process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-07 04:37:05 UTC
AV detection:
18 of 43 (41.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3kusjji7coyr6n62ytwqkcmaki2x23dyqfxbeheraxarq2jl2gra._file
Verdict:
malicious
Similar samples:
2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324
RaccoonStealer
4138442b73cdafa8f00d78734836ef77dffe605631277f562c9ae06f1d8d7b3c
RaccoonStealer
4c89265179f2471e24688ac126c541886173be7773617450b0849cb48a5a293d
RaccoonStealer
560d1e1c846bb66402c793a3e44991b637d82d1ce3ef6c89e443b9b2602b6e3b
RaccoonStealer
647ff6bf6f905c771a13ed6b0d5fdfe0b7c418559b7e59d27bfdc9935ef3e056
RaccoonStealer
6f746dfc7c53944b60e4fdc29fdea740ae8ceaf98126262258fd38ecf166cba5
RaccoonStealer
9fc2a95067df754bbafd860e8a3d5b5881ae097fe107aeff86d4945830fcbba7
RaccoonStealer
ba6500d3d342ecdbca59b6c47b9b6e078bb54365ffe5be38f958983a7715645d
RaccoonStealer
bfdb06e19260107f468834d5601f7f295ca82b31966be48f856011d9dba1f5b7
RaccoonStealer
ffe39579163c231521098435348019227cca339b735efa33b639acf5bcbaf432
RaccoonStealer
+ 1'827 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:c0a9feb2a4e39ae5dc9126aeda03d4a8d900a1bf botnet:e89524de1a131be43c3cc9ec324dabb6a9998c12 botnet:fe582536ec580228180f270f7cb80a867860e010 botnet:newnew backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210907-e8th2aeher/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://fazanaharahe1.xyz/
http://xandelissane2.xyz/
http://ustiassosale3.xyz/
http://cytheriata4.xyz/
http://ggiergionard5.xyz/
http://rrelleynaniy6.store/
http://danniemusoa7.store/
http://nastanizab8.store/
http://onyokandis9.store/
http://dmunaavank10.store/
http://gilmandros11.site/
http://cusanthana12.site/
http://willietjeana13.site/
http://ximusokall14.site/
http://blodinetisha15.site/
http://urydiahadyss16.club/
http://glasamaddama17.club/
http://marlingarly18.club/
http://alluvianna19.club/
http://xandirkaniel20.club/
185.167.97.37:30904
45.14.49.232:14970
Unpacked files
SH256 hash:
00f084577498574656aee0e4ce71090d1127e61b121ded642095d8abafa8faad
MD5 hash:
1ebf9a8027fe82a4416188d52ee12a8c
SHA1 hash:
b78dd61046152043e8a4c7a4b144d7d94c9c0867
Link:
https://www.unpac.me/results/5366a27d-0ab0-494c-a1a3-8c6d30ed8fdb/
SH256 hash:
daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2
MD5 hash:
207bb33577d0f8f3831a45858138d96b
SHA1 hash:
7a4f99fa0a75a6ddcab1901de445b3b2f4ea3267
Link:
https://www.unpac.me/results/5366a27d-0ab0-494c-a1a3-8c6d30ed8fdb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/daa924a51f13/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe daa924a51f13b11f37dac4ed05098052357d6c78816e121c9105c118692bd1a2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1558724/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/185790/

Comments