MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29
SHA3-384 hash:	d62a108bc78cc75a2ba41b58103a89180c92ee0530d3f0aeac09b2ad80c7af166b5119f79ae241d72b2af7ef059237e2
SHA1 hash:	97ed8da03e02cf338871558b6d73f7e708eefa60
MD5 hash:	b147f58ffee25ee8ef9cdae4198fed71
humanhash:	hawaii-sad-three-steak
File name:	b147f58ffee25ee8ef9cdae4198fed71
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	562'688 bytes
First seen:	2021-09-10 07:10:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	60cc0daaa74806110a4d23b786f367f8 (2 x RaccoonStealer, 1 x Stop)
ssdeep	12288:AS0ZZbnGSA3DYl2NabxUDzGuD4EpyE1J9A38uuLMvM2y:irnGSuDqUDKuD40JS
TLSH	T147C4DF30AA90C074F5B712F485BA877CA9E97E709B3050CB52D42AEE1A316F4ED3075B
dhash icon	d824e7d0c4e72158 (6 x RaccoonStealer, 5 x Stop, 2 x ArkeiStealer)
Reporter	zbetcheckin
Tags:	32 exe RaccoonStealer

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b147f58ffee25ee8ef9cdae4198fed71

Verdict:

Malicious activity

Analysis date:

2021-09-10 07:10:40 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/8fab343f-aef1-4b59-ad76-ef8d90158e72

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/186809/

Detection(s):

Win.Packed.Generic-9888857-0

Win.Malware.Generic-9888860-0

Win.Packed.Generickdz-9890248-0

Win.Packed.Generickdz-9890265-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt to an infection source

Connection attempt

Sending a UDP request

Query of malicious DNS domain

Sending a TCP request to an infection source

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2789c907-b099-4e1d-beff-dec5422441d4

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/848632

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

raccoon

Link:

https://mwdb.cert.pl/sample/f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-08-28 13:23:46 UTC

AV detection:

39 of 45 (86.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ogsqllcpn3e7ylu4m6t5zaie6l2woodspu7zhzdc7eld2bsniuq._file

Verdict:

malicious

Label(s):

raccoon

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:d02c5d65069fc7ce1993e7c52edf0c9c4c195c81 stealer

Link:

https://tria.ge/reports/210910-hzym6scgcm/

Behaviour

Modifies system certificate store

Raccoon

Unpacked files

SH256 hash:

fc4e10219fe2313fedef57c199bab6c22f0db36f517224abd9d9f7cb560b666a

MD5 hash:

00b9c6a81b13c859b1159d7732bb04be

SHA1 hash:

303152135355f20a0ab244cec9311806dae83a46

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/8e179c13-81a7-4a8c-9518-9ae51ebd11e6/

Parent samples :

ac63474c04736ab2b250230f4a47d589ece05b7839df739d16c1db622b80db19
c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972
f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29

SH256 hash:

f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29

MD5 hash:

b147f58ffee25ee8ef9cdae4198fed71

SHA1 hash:

97ed8da03e02cf338871558b6d73f7e708eefa60

Link:

https://www.unpac.me/results/8e179c13-81a7-4a8c-9518-9ae51ebd11e6/

Malware family:

Raccoon v1.7.2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f38d282d627b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f38d282d627b764fe174e33d3ee4082797ab39c393e9fc9f2317c8b1e8326a29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers