MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3
SHA3-384 hash: fb9436a6e8dd40b640ba531d77bceaae01c5b40c0e23dc8698aba910fabc9382f026c3530e409c0797de4284ee5e5188
SHA1 hash: 89911cec0439cb423742d6615f64e13fa3065753
MD5 hash: f0675a345759fed3eae6fc51c71b19c4
humanhash: steak-asparagus-double-emma
File name:f0675a345759fed3eae6fc51c71b19c4.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:431'620 bytes
First seen:2021-11-04 17:21:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fbe4cce31825940f582af9763f8c6fb6 (4 x RaccoonStealer, 2 x RedLineStealer, 2 x Smoke Loader)
ssdeep 12288:7mJ/eAZN5bOSTk06wd9BcGBCDbDAPkFFRBGlBbDz:7ke8N/A06wVBmbMmFyL
TLSH T19994021136E2C073E1F796744D74D6B46EFA7C93293C818BF76426392E301F06A267A6
File icon (PE):PE icon
dhash icon 480c1c4c4f594b14 (172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey)
Reporter abuse_ch
Tags:exe RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f0675a345759fed3eae6fc51c71b19c4.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-04 18:27:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7b77507d-e80a-44d8-a1f7-0c0fe0acea24

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/202426/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/618416bfc03a81a5024036d6/reports/4e95e16f-15d7-4e78-ba61-4614f589695e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5430fbb-2f36-44f3-8651-2ae4a482f738
Result
Threat name:
Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/883422
Signature
C2 URLs / IPs found in malware configuration
Found detection on Joe Sandbox Cloud Basic with higher score
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 515856 Sample: 5pdBE1AE2Y.exe Startdate: 04/11/2021 Architecture: WINDOWS Score: 76 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected Raccoon Stealer 2->26 28 Found detection on Joe Sandbox Cloud Basic with higher score 2->28 30 2 other signatures 2->30 7 5pdBE1AE2Y.exe 2->7         started        process3 signatures4 32 Injects a PE file into a foreign processes 7->32 10 5pdBE1AE2Y.exe 7->10         started        process5 process6 12 WerFault.exe 2 9 10->12         started        16 WerFault.exe 23 9 10->16         started        dnsIp7 22 192.168.2.1 unknown unknown 12->22 18 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 12->18 dropped 20 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->20 dropped file8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-04 17:22:06 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:b3ed1d79826001317754d88a62db05820a1ecd19 stealer
Link:
https://tria.ge/reports/211104-vxkdzsecbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Raccoon
Unpacked files
SH256 hash:
25a4b6c6b34adf706411f6f6b91c46de7a80728964492e6eb11f2281e9678717
MD5 hash:
2f9b640b36cbd54b3c835289cc8075cd
SHA1 hash:
9e849ddf0cbb3291065a12408bc798c7cd7686d9
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/34c34093-7fb4-4b93-89f9-97de75279972/
Parent samples :
a972fe56cf0c891775ab81e23a90e553956c06623350fc91d4e7cdce3dfd3170
35405fdecc554572244c745e390644ae713070f0bf81b29b9b54f6a738cb0ea5
e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3
51785594b835ee188972c80f514ce698ed1262e0628c66df1d9e1ae23d484476
SH256 hash:
e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3
MD5 hash:
f0675a345759fed3eae6fc51c71b19c4
SHA1 hash:
89911cec0439cb423742d6615f64e13fa3065753
Link:
https://www.unpac.me/results/34c34093-7fb4-4b93-89f9-97de75279972/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e040228b7cce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe e040228b7cce711e455d0772d77287448cf14eea496563a3474c69565cc441d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1738451/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202426/

Comments