MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RaccoonStealer
Vendor detections: 16
| SHA256 hash: | fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b |
|---|---|
| SHA3-384 hash: | 0f782517bd0b2e877f7158d8aadf9e6e53b099c48891671f4b631f84bdc7836e28a97eeb6866834e6d99902ce237baa8 |
| SHA1 hash: | 715ec3f93f4956cab6ed4770321702c5ca3e77d0 |
| MD5 hash: | 33abd0fdcd6ada3388f441eb25c4a383 |
| humanhash: | ink-bravo-timing-cardinal |
| File name: | 33abd0fdcd6ada3388f441eb25c4a383.exe |
| Download: | download sample |
| Signature | RaccoonStealer |
| File size: | 526'848 bytes |
| First seen: | 2021-12-08 17:25:56 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 40946eb7f18ff06bd788849825e1d2cd (2 x RedLineStealer, 1 x CryptBot, 1 x RaccoonStealer) |
| ssdeep | 6144:OiBLdwlhOjzDvO7B3Jpf3WPUxjNi7G/tP/TtPkTwj1x89rGOVauzbgwu6L7ITsqs:/Bx4Ojz7GBHMG/lbt1jH81aunnn7s |
| Threatray | 4'436 similar samples on MalwareBazaar |
| TLSH | T1EFB4F1F3B6E98873C4532D3054119AB01A3BBD66D960910AF634675E2FB3BCC55E232E |
| File icon (PE): |  |
| dhash icon | fcfcd4f4d4d4d8c0 (23 x RedLineStealer, 21 x RaccoonStealer, 6 x Smoke Loader) |
| Reporter |  abuse_ch |
| Tags: | exe RaccoonStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
33abd0fdcd6ada3388f441eb25c4a383.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-08 17:31:51 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Raccoon
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
9/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CPUID_Instruction
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
anti-vm greyware packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Raccoon
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Raccoon
Status:
Malicious
First seen:
2021-12-08 17:26:10 UTC
File Type:
PE (Exe)
Extracted files:
82
AV detection:
25 of 28 (89.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
raccoon
Similar samples:
+ 4'426 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:fd4f23250443a724a3d1548e6ab07c481dfc2814 stealer
Behaviour
Raccoon
Unpacked files
SH256 hash:
f829ba13302ace3c84b0511f2c3b9c6afbb4ef3f55aacaef0203947f7b554e8b
MD5 hash:
dcc654266daa83a416b8fd08d72c1d83
SHA1 hash:
b0d3a6b00211d53ce951111f9ed0353c43f28bfd
Detections:
win_raccoon_auto
Parent samples :
8016cf2a984909cad748683e27ecef70a65c417317b55e8b4031d0aec1f10f06
a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6
4d6db76398fa37523b40e69ac3ae9dea6d04c3c51cce4c0a72e5d312d14e5017
ea1c45c03a1e539f0bddb675416be1f9b3d49b35ab27c2a8d0d27eaff2fc8341
37277505c9c29a553b922916789287d97ec515d25dc2cb499ded717347efac9c
dcf88ad773f7a6b5a16e382d74b99a05bdba5eb282568436b32a6457720216ec
eefc11d7652518188e5cec696e4e45f774acc45b4d158cba71eb5a8cfe392736
fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b
a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6
4d6db76398fa37523b40e69ac3ae9dea6d04c3c51cce4c0a72e5d312d14e5017
ea1c45c03a1e539f0bddb675416be1f9b3d49b35ab27c2a8d0d27eaff2fc8341
37277505c9c29a553b922916789287d97ec515d25dc2cb499ded717347efac9c
dcf88ad773f7a6b5a16e382d74b99a05bdba5eb282568436b32a6457720216ec
eefc11d7652518188e5cec696e4e45f774acc45b4d158cba71eb5a8cfe392736
fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b
SH256 hash:
fbde62a000f3d5a4f36f330b0099416631854d0bf34e802f469c95d346f3222b
MD5 hash:
33abd0fdcd6ada3388f441eb25c4a383
SHA1 hash:
715ec3f93f4956cab6ed4770321702c5ca3e77d0
Malware family:
Raccoon v1.7.2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many email and collaboration clients. Observed in information stealers |
| Rule name: | MALWARE_Win_Raccoon |
|---|---|
| Author: | ditekSHen |
| Description: | Raccoon stealer payload |
| Rule name: | win_raccoon_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.raccoon. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.