MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43
SHA3-384 hash: 9ad34edd399fd23fa0e52dc0d816d8e94d5f82ab76534ea26306c9a18c2b32ac8def9af06c11f4e403d1b936a3974a8b
SHA1 hash: 1c60953e8782879af4dc21c761530693bf052612
MD5 hash: 5bf430688deacda4290f9efdcca428cb
humanhash: cola-oscar-eighteen-blossom
File name:5bf430688deacda4290f9efdcca428cb.exe
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:1'158'808 bytes
First seen:2022-03-08 18:30:58 UTC
Last seen:2022-03-08 20:45:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 24576:qXKp/KzVc4OV7dtm788OFjAODFbYbQ7BddDmKdkEaHNYK36Xe:qX6Kc4x8jFjAODZYktddioNacXe
TLSH T1D935332A6360CC26C57F52BE26625CB224A5BC5C0D845563F67F87C90F09A3BE63E1F4
Reporter abuse_ch
Tags:exe RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://101.99.95.5/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://101.99.95.5/ https://threatfox.abuse.ch/ioc/393044/

Intelligence

File Origin
# of uploads :
2
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Raccoon
Create hunting rule
Link:
https://www.capesandbox.com/analysis/248460/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending an HTTP GET request
Sending an HTTP POST request
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6227a0ea0cd58dbd9268a6d2/reports/70055109-f482-4493-9c97-91a7586ec575/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f39b6d6a-fd6c-45bd-b500-6ac2508309d3
Result
Threat name:
Clipboard Hijacker Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/952876
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
Contains functionality to compare user and computer (likely to detect sandboxes)
DLL side loading technique detected
Found evasive API chain (may stop execution after checking mutex)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Sigma detected: Suspicius Schtasks From Env Var Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 585355 Sample: nStptWxj5K.exe Startdate: 08/03/2022 Architecture: WINDOWS Score: 100 80 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->80 82 Malicious sample detected (through community Yara rule) 2->82 84 Antivirus detection for URL or domain 2->84 86 6 other signatures 2->86 10 nStptWxj5K.exe 1 2->10         started        13 oobeldr.exe 2->13         started        15 qweqwe.exe 2 2->15         started        process3 signatures4 94 Writes to foreign memory regions 10->94 96 Allocates memory in foreign processes 10->96 98 Injects a PE file into a foreign processes 10->98 17 AppLaunch.exe 82 10->17         started        22 conhost.exe 10->22         started        100 Found evasive API chain (may stop execution after checking mutex) 13->100 102 Contains functionality to compare user and computer (likely to detect sandboxes) 13->102 24 schtasks.exe 1 13->24         started        process5 dnsIp6 68 101.99.95.5, 49772, 80 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY Malaysia 17->68 70 85.159.212.113, 49771, 80 LINODE-APLinodeLLCUS United Kingdom 17->70 72 95.143.178.121, 49781, 80 RHTEC-ASrh-tecIPBackboneDE Russian Federation 17->72 58 C:\Users\user\AppData\...\S2OH1fyx5x.exe, PE32 17->58 dropped 60 C:\Users\user\AppData\LocalLow\...\nss3.dll, PE32 17->60 dropped 62 C:\Users\user\AppData\...\mozglue.dll, PE32 17->62 dropped 64 57 other files (1 malicious) 17->64 dropped 88 Tries to steal Mail credentials (via file / registry access) 17->88 90 Tries to harvest and steal browser information (history, passwords, etc) 17->90 92 DLL side loading technique detected 17->92 26 S2OH1fyx5x.exe 4 17->26         started        30 conhost.exe 24->30         started        file7 signatures8 process9 file10 66 718fa68a53ff1a5441...de2658bb95f65d3.exe, PE32 26->66 dropped 104 Tries to delay execution (extensive OutputDebugStringW loop) 26->104 32 718fa68a53ff1a5441b00bc58de2658bb95f65d3.exe 1 26->32         started        36 cmd.exe 2 26->36         started        38 cmd.exe 1 26->38         started        40 cmd.exe 2 26->40         started        signatures11 process12 file13 54 C:\Users\user\AppData\Roaming\...\oobeldr.exe, PE32 32->54 dropped 74 Found evasive API chain (may stop execution after checking mutex) 32->74 76 Uses schtasks.exe or at.exe to add and modify task schedules 32->76 78 Contains functionality to compare user and computer (likely to detect sandboxes) 32->78 42 schtasks.exe 1 32->42         started        56 C:\Users\user\AppData\Roaming\...\qweqwe.exe, PE32 36->56 dropped 44 conhost.exe 36->44         started        46 conhost.exe 38->46         started        48 schtasks.exe 1 38->48         started        50 conhost.exe 40->50         started        signatures14 process15 process16 52 conhost.exe 42->52         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-03-07 23:31:53 UTC
File Type:
PE (Exe)
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pgqy7pjq6gzza4er2fn6oytlq2o3zq46ook5xsf5i7sqvohpzbq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220308-w52tnsdcdn/
Behaviour
Program crash
Unpacked files
SH256 hash:
2f24e8f879ca8728dbdfb44a75192570412c2c671dd2e9b575075f3f904e9678
MD5 hash:
4da78a0c8bca1db22fe773494d91e29f
SHA1 hash:
64839fab75d921be2498bd4b2f57cbb96fb897da
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/55e8b0c7-a616-493b-a7bd-593c466a359b/
Parent samples :
ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43
6fda4979c793ff6828e27f46a27df0e5096ea53abe280aefe4e0e37f81b88ea4
SH256 hash:
94893787d08677d29109fb5b48298b23446dc4da73c5fb87053e3ac916890cbb
MD5 hash:
95b509e55f2857c997b3b74d85213a9c
SHA1 hash:
f7866863cd9972118383351318f9cbb2182ad138
Link:
https://www.unpac.me/results/55e8b0c7-a616-493b-a7bd-593c466a359b/
SH256 hash:
ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43
MD5 hash:
5bf430688deacda4290f9efdcca428cb
SHA1 hash:
1c60953e8782879af4dc21c761530693bf052612
Link:
https://www.unpac.me/results/55e8b0c7-a616-493b-a7bd-593c466a359b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ebcd0c7de987/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/248460/

Comments