MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3e0ef03507f9723efca65f6fc9b1debe58797c3537f29f503b3b721af70b55a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	f3e0ef03507f9723efca65f6fc9b1debe58797c3537f29f503b3b721af70b55a
SHA3-384 hash:	8d341c11d35c67adaac8a3a2c274d7c83c1f77314104000defa5edd63bd685c886f5a8a547d30f7616e17d11070f8559
SHA1 hash:	e18b6d9b3900606f55e2003c5b93a431bb4c7b59
MD5 hash:	88fd603f18b760e004251ff4cf5947ff
humanhash:	indigo-coffee-single-black
File name:	88fd603f18b760e004251ff4cf5947ff.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	541'184 bytes
First seen:	2020-06-20 12:51:15 UTC
Last seen:	2020-06-20 13:41:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fbb1f2f70588968a5c326c00dd5f7eea (6 x RaccoonStealer, 1 x Stop)
ssdeep	12288:WjOPgwtVBNUiao0dQ2eqox9Pk5Xli4KSOZ0:6wjB2ix0dQEoj83RKjZ0
TLSH	39B4F10335D4C0B8E4670B7159628E60463FFDF29AB0545777C82B4E0E722E0AE6B66F
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://35.226.139.169/gate/log.php

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/12325/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-06-20 12:53:04 UTC

AV detection:

29 of 31 (93.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6pqo6a2qp6lsh36kmx3pzgy55psypf6dkn7st5idwo3sdl3qwvna._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-jfyzhkksfe/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_raccoon_a0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	win_raccoon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator