MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e81891e0cdea85bf674e771a8a987cc3c17e9767aac31b25a36d97e15a66e969. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e81891e0cdea85bf674e771a8a987cc3c17e9767aac31b25a36d97e15a66e969
SHA3-384 hash: d6680c380166c23d904f36549e8b71e7bd2e382f7d76f6882e5ebe1a4ef476490c328da84c576235afcdc66d21327fb7
SHA1 hash: d2df0ccdb20c84e3193e9b46ca37f1fb0290c048
MD5 hash: 5837ce63d1a4d45810bf21a87ae0ca93
humanhash: nineteen-utah-blue-alpha
File name:SecuriteInfo.com.BehavesLike.Win32.PUPXEU.hc.22680
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:553'984 bytes
First seen:2020-05-15 19:31:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a0a9fa6380c1af60a24212d07a02c4a5 (2 x RaccoonStealer)
ssdeep 12288:CV+Rr/lWJ0MPQd6YMAz3qQWtwz96jr+N:CQZKxPQb3qnOMjr+
Threatray 65 similar samples on MalwareBazaar
TLSH 39C4D001E3E1B635E6B34E365E3DD3A4AE3EB941AD3862C9139A5E1F0D703A1C563706
Reporter SecuriteInfoCom
Tags:RaccoonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.PUPXEU.hc.22680.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 17:36:19 UTC
File Type:
PE (Exe)
Extracted files:
70
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5amjdygn5kc36z2oo4nivgd4ypax5f3hvlbrwjndnwl6cwtg5fuq._file
Verdict:
unknown
Similar samples:
00f033089c4ab1e6d8faadf191abc4877bdb56e422b42880e027bcf12ad21f4d
RaccoonStealer
01409a8c1a4815214036cdac1796e2a6b680f7149b2117346a1f01b809a18754
RaccoonStealer
025d420ff6377113c978e8ae774aba4fa57aa750c76181f30ce9dff7e08060e8
RaccoonStealer
07bfebe8d71ba6f9d0f0b05d40648777a4200a5811a1c6000f825c6d3e8246a4
RaccoonStealer
52bfb01a8cb2ad9893c08a518653e33f7382c7f0419461e983af6523b67a6dcd
RaccoonStealer
61c47bc44d3877e815be609e98f97eb1b79ee1c9215646570d85cc40aa9c1317
RaccoonStealer
a76b1ee42bf46e97b2b59192ad8ba7a53d8ec626f36c043540f0d2f4ae8c8d4b
RaccoonStealer
accea9256a425eb64eb34ced6ae9e6090ce8117241df2d5e7d3e0a2ec5b232c9
RaccoonStealer
beb2824122982ae356642d0d46c7fba54424687558a35df7e0b22263f9587332
RaccoonStealer
e6d287e8934bea3f8c237e9095cfebd7e629bb2a9624eafc0b26065e0e03485f
RaccoonStealer
+ 55 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-cfm6wwhg22/
Behaviour
Modifies system certificate store
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

Executable exe e81891e0cdea85bf674e771a8a987cc3c17e9767aac31b25a36d97e15a66e969

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/363091/
  
Delivery method
Distributed via web download

Comments