MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaccoonStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 2 File information Comments

SHA256 hash:	f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
SHA3-384 hash:	0ef6c86715cae9a237a7842206002a4b60e898a62ef529be07d59729eab24debfc0d46818fb0195456d97cc0d1f0257a
SHA1 hash:	8c6b6b2922f8e5855b209a89caa85fa5e7141e36
MD5 hash:	863a8a21eb99b20d4220540da5bc05c3
humanhash:	mississippi-burger-blossom-zebra
File name:	863a8a21eb99b20d4220540da5bc05c3.exe
Download:	download sample
Signature	RaccoonStealer Create hunting rule
File size:	573'952 bytes
First seen:	2021-09-22 06:10:37 UTC
Last seen:	2021-09-22 07:14:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	64db17fb74f0fc4cbe32aa2e57d24a0f (17 x RedLineStealer, 6 x RaccoonStealer, 4 x ArkeiStealer)
ssdeep	12288:K3lp31Ii5vdLGpUGAO8oJCsuILunn7fFDSVCD9X7D7rJrs1+:q1Ii5jlocsu8cnDgVK9LD7ds
Threatray	3'224 similar samples on MalwareBazaar
TLSH	T160C4E0307AE0C034F1F702F889BAA368B93D79B16B7451CB66D11AEA56346E49C31397
File icon (PE):
dhash icon	ead8ac9cc6a68ee0 (93 x RedLineStealer, 50 x RaccoonStealer, 15 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RaccoonStealer

abuse_ch

RaccoonStealer C2:
http://185.163.45.42/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.163.45.42/	https://threatfox.abuse.ch/ioc/224597/

Intelligence

File Origin

# of uploads :

# of downloads :

204

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

863a8a21eb99b20d4220540da5bc05c3.exe

Verdict:

Malicious activity

Analysis date:

2021-09-22 06:12:38 UTC

Tags:

trojan stealer raccoon

Link:

https://app.any.run/tasks/358e82ff-de5e-43c9-be95-ffd22ef4a9fd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/190062/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.23876.31852.13503.UNOFFICIAL

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/470706d8-91a0-4353-a2e2-64c6ad0b0809

Result

Threat name:

Raccoon

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/855355

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Self deletion via cmd delete

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Raccoon Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

raccoon

Link:

https://mwdb.cert.pl/sample/f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845/

Threat name:

Win32.Ransomware.LockbitCrypt

Status:

Malicious

First seen:

2021-09-22 06:11:10 UTC

AV detection:

20 of 45 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7f63usogblwnurkxtejsxlf7xsuuyrpc53rotma4cgsilzj2jbcq._file

Verdict:

malicious

Label(s):

raccoon

RaccoonStealer

39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7

RaccoonStealer

3c2557c292a2e3a61a85cd44f45f8f3998fd16db3e5e523353eac61a879f726a

RaccoonStealer

77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7

RaccoonStealer

7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332

RaccoonStealer

8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6

RaccoonStealer

9a10fedc08825568afd8a1549c894acc2e0b8a124663b1e13e0903817c996636

RaccoonStealer

ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a

RaccoonStealer

dba5e6264deed1c0d630810ce0ba5931e442398ab117ab551f05e77d69613bfb

RaccoonStealer

dd32ec7e9a26563e3088286af32a147b95988188302c65024ed97a5a3b6289c6

RaccoonStealer

+ 3'214 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon discovery spyware stealer

Link:

https://tria.ge/reports/210922-gxlp6abff8/

Behaviour

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Modifies system certificate store

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

Unpacked files

SH256 hash:

2b846276cddcb96a51df3052f4f63232f4a9615e08df959342185ed0255c3f0c

MD5 hash:

6f5936f1ebe731d1069daa1b20473a6f

SHA1 hash:

e83bd74f6ebb2b095cffb5f534c3ad1d0017c7c3

Detections:

win_raccoon_auto

Link:

https://www.unpac.me/results/a8fcd125-09b0-48d9-adf7-36e7073118a3/

Parent samples :

d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45
8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6
726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768
39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7
7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332
77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7
f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399
ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a
f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845
940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb
d720677c3d1ae4e2048fba7ff9a80839affa35f45f6abd2643b0de4a0f9bc997
240ff23832abc300cef55adc3f5f10fffe8b617b1f4e83979bef40c82c03f244

SH256 hash:

f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845

MD5 hash:

863a8a21eb99b20d4220540da5bc05c3

SHA1 hash:

8c6b6b2922f8e5855b209a89caa85fa5e7141e36

Link:

https://www.unpac.me/results/a8fcd125-09b0-48d9-adf7-36e7073118a3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers