MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fddafc863ca9e1f9efc8918b400546d014415aaabf0eb21f423dcf16d7024964. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaccoonStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fddafc863ca9e1f9efc8918b400546d014415aaabf0eb21f423dcf16d7024964
SHA3-384 hash: d8718533ff9f545d1fb4bd42cfca0331a9fc1c33e4f0913be471537e87e9cf7c056ee0e12dc7f554a6594c226612cefd
SHA1 hash: 259586adf0a99526a9a738ece5892f18116cc907
MD5 hash: 5218a8fb0252f85872a79c65290660a9
humanhash: spaghetti-video-river-hot
File name:5218A8FB0252F85872A79C65290660A9.dll
Download: download sample
Signature RaccoonStealer
Create hunting rule
File size:578'560 bytes
First seen:2021-08-29 23:06:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3088a336617802055bd2c5ce6245c8b0 (2 x RaccoonStealer)
ssdeep 12288:0uEN5+TOOyJ2mWUz/FnBEqtz5scr3jfaNOru4mvmKL4d:0uENMTW2mWUz/FyqtuU63vlcd
Threatray 3'904 similar samples on MalwareBazaar
TLSH T1B9C4AD6272518072F17E0030ACA8ABB5167DBCB149B54EA7B7C9463E1FF45C2D721B2B
Reporter abuse_ch
Tags:dll RaccoonStealer


Avatar
abuse_ch
RaccoonStealer C2:
http://5.181.156.252/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.252/ https://threatfox.abuse.ch/ioc/201911/

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183328/
Detection(s):
SecuriteInfo.com.Variant.Doina.22364.6793.8826.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0b20a005-db3c-4e47-911c-8f21869b0b54
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/841149
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 473580 Sample: 2IpVmbtwjn.dll Startdate: 30/08/2021 Architecture: WINDOWS Score: 84 39 Multi AV Scanner detection for domain / URL 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Machine Learning detection for sample 2->45 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 80 8->10         started        15 cmd.exe 1 8->15         started        17 rundll32.exe 8->17         started        dnsIp5 35 5.181.156.252, 49704, 80 MIVOCLOUDMD Moldova Republic of 10->35 37 telete.in 195.201.225.248, 443, 49703 HETZNER-ASDE Germany 10->37 27 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 10->27 dropped 29 C:\Users\user\AppData\...\vcruntime140.dll, PE32 10->29 dropped 31 C:\Users\user\AppData\...\ucrtbase.dll, PE32 10->31 dropped 33 56 other files (none is malicious) 10->33 dropped 47 System process connects to network (likely due to code injection or exploit) 10->47 49 Tries to steal Mail credentials (via file access) 10->49 51 Tries to harvest and steal browser information (history, passwords, etc) 10->51 19 cmd.exe 1 10->19         started        21 rundll32.exe 15->21         started        file6 signatures7 process8 process9 23 conhost.exe 19->23         started        25 timeout.exe 1 19->25         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fddafc863ca9e1f9efc8918b400546d014415aaabf0eb21f423dcf16d7024964/
Threat name:
Win32.Trojan.Bingoml
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 23:55:07 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xnpzbr4vhq7t36isgfuabkg2akecwvkx4hleh2chxhrnvycjfsa._file
Verdict:
unknown
Similar samples:
445bd1c221cff019e52db89d03e05a8c22509cea0ede28da6d55bff7fd840bae
RaccoonStealer
895100760e67763505b9cad311be16b533db48d1f2cb28424a98495406220a2f
RaccoonStealer
9d4a0a8ffa11fc953750c07bd6997bcd23871fe277f65b4113e197b779aa24f0
RaccoonStealer
a17024fcd2de08eaddf6e1a317c3a9106410cd8d536fd7e9520899370f97e69c
RaccoonStealer
d8eb6d3fe02a890173827c242182acd22aa699e4bbd918fd22b95c00aa3a6445
RaccoonStealer
da8777fa1ea919560e5fd0fcad56f265546fa9fa5e061776705da8a79ec1ca7c
RaccoonStealer
fa40dc2c8055f953099d7d354ba97fbf3a5f3aa501ce95cb8cefa810b80ea5d4
RaccoonStealer
ff1ddb96f4984d4ed65016ca7814432d51a08fe090fae4907e85926469e880da
RaccoonStealer
+ 3'894 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210829-h792atq1v2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Modifies system certificate store
Program crash
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Unpacked files
SH256 hash:
fddafc863ca9e1f9efc8918b400546d014415aaabf0eb21f423dcf16d7024964
MD5 hash:
5218a8fb0252f85872a79c65290660a9
SHA1 hash:
259586adf0a99526a9a738ece5892f18116cc907
Detections:
win_raccoon_a0
Create hunting rule
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/9e7bbc02-9c05-4c27-8f61-a5401a62d9b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fddafc863ca9e1f9efc8918b400546d014415aaabf0eb21f423dcf16d7024964

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/183328/

Comments