MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de7f5d23f01e6db39776b8d70262dbdba511cb42aa65a71e1e3166ab91806da9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de7f5d23f01e6db39776b8d70262dbdba511cb42aa65a71e1e3166ab91806da9
SHA3-384 hash: cb671fb673a986d5f04914ef48e2bad2da22b7f7c1a8075dc957b8209957cf0daaadb90f2ccb3c4cab2da59e042862f3
SHA1 hash: 6d75d8af2740a86941779287fad068f6c49650c4
MD5 hash: 092c9a0a66c16e114e3c2e301d313810
humanhash: violet-video-football-earth
File name:092c9a0a66c16e114e3c2e301d313810.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:554'496 bytes
First seen:2020-05-16 11:20:21 UTC
Last seen:2020-05-16 12:19:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8965f367240e2ba1e792dda7ae552016 (1 x RaccoonStealer)
ssdeep 6144:rzIJ0WpvHnECjktKkH8brk3sVXtGPPou4yKM8FKLwqn/M8vLWWceAXElaAqgsbZV:r0ZhHnbjR2sd05x/MeLrcT2lqr+w
Threatray 318 similar samples on MalwareBazaar
TLSH 5CC4DF01F3E1D731D1B70A7A9D7D97A49E36BD01BE3852CA23161E1F9DB13908A26707
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-16 07:44:51 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3z7v2i7qdzw3hf3wxdlqeyw33osrds2cvjs2ohq6gftkxemanwuq._file
Verdict:
malicious
Similar samples:
0335616afb9c546d9580cd2656fdad8758f4daa215c39a0c14a0fc68a5c129f0
RaccoonStealer
42a4a241b85a3c8bcd335504f822791859a2e74df645c70951996b35b53212d6
RaccoonStealer
55f47d6441e8fcd7ceb49d115588163c5a2941a2ed954b0a8e09b82233d7de4c
RaccoonStealer
65eccb834f29444214038fec3ecd6f53dee3d98743d8a80f824471c8f153224e
RaccoonStealer
af144fecf75bb3b83d364a523b10f5a825b50f27017060112c17dbf668a5040a
RaccoonStealer
cb96624fc5ed1dca5e1cbca928966a8e9e906817991314675e51fd98f83eb2a7
RaccoonStealer
d3025e6ca15f2f2c1ee931ecc075982f65e95cbbb367762874966472fa168cf6
RaccoonStealer
e40b804cdb66cb7f2141d1cb0dd2933cca2cdca549e47c0e059813d51d25987a
RaccoonStealer
ef3a1f525f383f8d5000a9f6fe4337f3c561ad41157d7cbb1bb2905aea18435c
RaccoonStealer
fd3faad0a3b4f30c9e4bc4940b811eb844275de784cb0548bef38793c514e70e
RaccoonStealer
+ 308 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-rxy7rc9mz6/
Behaviour
Modifies system certificate store
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe de7f5d23f01e6db39776b8d70262dbdba511cb42aa65a71e1e3166ab91806da9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/363091/
  
Delivery method
Distributed via web download

Comments