MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb1a5931076e4e43de9c5bb686d2a6f2e60fc33218e272564e559651340ebf1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments 1

SHA256 hash:	eb1a5931076e4e43de9c5bb686d2a6f2e60fc33218e272564e559651340ebf1a
SHA3-384 hash:	6a9f7f2c142da7c0107090b33f602d72b7cc5acf89185702a29317b6370920786a71a74f1e30531d7c604f4c169346d6
SHA1 hash:	81a8115ce2a3c2da73e54efa0a025a41d0d76991
MD5 hash:	d42a635732b92537e039a17f2591451d
humanhash:	yellow-pip-single-fifteen
File name:	d42a635732b92537e039a17f2591451d.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	566'784 bytes
First seen:	2021-05-20 14:13:02 UTC
Last seen:	2021-05-20 20:10:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5ee1e46776fdb5a3bd242a0d3fac4b11 (2 x RaccoonStealer)
ssdeep	12288:yDeM13l3tRJbH3iZEA06qmA4FXZRAWEq8GzjIeHFFgh:yHtlBTA06qYaWYAjNFK
Threatray	985 similar samples on MalwareBazaar
TLSH	40C4D03166A1C034E4B312F559BA82B8AE39F9B3273450CF12D5EAFA47745E0AC31797
Reporter	abuse_ch
Tags:	exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/159688/

Detection(s):

Win.Malware.Raccoon-9862901-1

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a TCP request to an infection source

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb1a5931076e4e43de9c5bb686d2a6f2e60fc33218e272564e559651340ebf1a/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2021-05-19 10:36:58 UTC

AV detection:

30 of 47 (63.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5mnfsmihnzhehxu4lo3inuvg6lta7qzsddrhevsokwlfcnaox4na._file

Verdict:

malicious

RaccoonStealer

17a54b98e0fa1559a540e2ec3c30f0c23d8a8cbe7b18c8fe1f4241945f314e5e

RaccoonStealer

27614f810715e1ac5987d10abdac7e101227f1ff49e470cd0fee680c604d672d

RaccoonStealer

4c2dc9d041a919e8367ee723c5a9b8ebcdc41c9e9495b333242d14ce3bb4a2a4

RaccoonStealer

8896dd2a44120202a979a9c6caa747861d0a5bb77d46ca475384c000e7f0bd57

RaccoonStealer

b2f42e0c46898da53cb52d2d1a7f7ea2a090b08491c8b89a4e155cf77b6ab9ed

RaccoonStealer

d4a3dfb58cd914442e87bc43526948179b85c2ed4483f8421ba4a882fadbe519

RaccoonStealer

f8bf48e34c4002e07e7c57dc4eee52abe141b8a9cfb693325229f56cca507d40

RaccoonStealer

fb5d2b6d9ec1b9c07e64f6b9eb148099f0b43d58dc867102c02b16a9a9152022

RaccoonStealer

fd6ba9b7188a0b11c92287c273eea76f688576dc07eb73b4b42bb0bf061fb393

RaccoonStealer

+ 975 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:88cd0f861c0c35b834a6d4d6e91c9e9bd00f4226 spyware stealer

Link:

https://tria.ge/reports/210520-bcy9lq3676/

Behaviour

Modifies system certificate store

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eb1a5931076e4e43de9c5bb686d2a6f2e60fc33218e272564e559651340ebf1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	MALWARE_Win_Raccoon Create hunting rule
Author:	ditekSHen
Description:	Detects Raccoon/Racealer infostealer

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RaccoonStealer

exe eb1a5931076e4e43de9c5bb686d2a6f2e60fc33218e272564e559651340ebf1a

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1250973/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/159688/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-20 15:30:12 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0045] File System Micro-objective::Copy File
4) [C0049] File System Micro-objective::Get File Attributes
5) [C0051] File System Micro-objective::Read File
6) [C0052] File System Micro-objective::Writes File
7) [C0007] Memory Micro-objective::Allocate Memory
8) [C0033] Operating System Micro-objective::Console
9) [C0040] Process Micro-objective::Allocate Thread Local Storage
10) [C0043] Process Micro-objective::Check Mutex
11) [C0041] Process Micro-objective::Set Thread Local Storage Value
12) [C0018] Process Micro-objective::Terminate Process