This malware is a successor to Raccoon Stealer (also referred to as Raccoon Stealer 2.0), which is however a full rewrite in C/C++.
rule win_recordbreaker_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.recordbreaker." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 2bf7 8bcf d1fe 56 53 e8???????? } // n = 6, score = 700 // 2bf7 | sub esi, edi // 8bcf | mov ecx, edi // d1fe | sar esi, 1 // 56 | push esi // 53 | push ebx // e8???????? | $sequence_1 = { 42 66890c38 8d0412 0fb70c30 663bcb } // n = 5, score = 700 // 42 | inc edx // 66890c38 | mov word ptr [eax + edi], cx // 8d0412 | lea eax, [edx + edx] // 0fb70c30 | movzx ecx, word ptr [eax + esi] // 663bcb | cmp cx, bx $sequence_2 = { 59 85c0 7408 6afe } // n = 4, score = 700 // 59 | pop ecx // 85c0 | test eax, eax // 7408 | je 0xa // 6afe | push -2 $sequence_3 = { 6a02 ff75fc ff15???????? 6a03 ff75fc ff15???????? 6a04 } // n = 7, score = 700 // 6a02 | push 2 // ff75fc | push dword ptr [ebp - 4] // ff15???????? | // 6a03 | push 3 // ff75fc | push dword ptr [ebp - 4] // ff15???????? | // 6a04 | push 4 $sequence_4 = { 8bd7 8bc8 e8???????? 8b15???????? 8bc8 e8???????? 8bd3 } // n = 7, score = 700 // 8bd7 | mov edx, edi // 8bc8 | mov ecx, eax // e8???????? | // 8b15???????? | // 8bc8 | mov ecx, eax // e8???????? | // 8bd3 | mov edx, ebx $sequence_5 = { 6a1a 53 6a00 8bf8 } // n = 4, score = 700 // 6a1a | push 0x1a // 53 | push ebx // 6a00 | push 0 // 8bf8 | mov edi, eax $sequence_6 = { 881e 46 49 83ea01 } // n = 4, score = 700 // 881e | mov byte ptr [esi], bl // 46 | inc esi // 49 | dec ecx // 83ea01 | sub edx, 1 $sequence_7 = { 8b15???????? 8bc8 e8???????? 8b55ec } // n = 4, score = 700 // 8b15???????? | // 8bc8 | mov ecx, eax // e8???????? | // 8b55ec | mov edx, dword ptr [ebp - 0x14] $sequence_8 = { 2bc6 d1f8 56 8d3c46 33c0 } // n = 5, score = 700 // 2bc6 | sub eax, esi // d1f8 | sar eax, 1 // 56 | push esi // 8d3c46 | lea edi, [esi + eax*2] // 33c0 | xor eax, eax $sequence_9 = { 8b4d0c 8b07 5f 5e } // n = 4, score = 700 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 8b07 | mov eax, dword ptr [edi] // 5f | pop edi // 5e | pop esi condition: 7 of them and filesize < 232312 }
import "pe" rule win_recordbreaker_w0 { meta: description = "Detect variants of Raccoon Stealer v2" author = "Jake Goldi" date = "2022-09-20" hash1 = "022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03" version="1.0" phase = "experimental" url = "https://d01a.github.io/raccoon-stealer/#iocs" references = "https://www.zscaler.com/blogs/security-research/raccoon-stealer-v2-latest-generation-raccoon-family" source = "https://raw.githubusercontent.com/taogoldi/YARA/main/stealers/raccoon/raccoon_stealer.yara" credits = "@0xd01a" malware = "Win32.PWS.Raccoon" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker" malpedia_rule_date = "20220921" malpedia_hash = "" malpedia_version = "20220921" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $s1 = "ffcookies.txt" wide ascii nocase $s2 = "wallet.dat" wide ascii nocase $s3 = "ru" wide ascii nocase $s4 = "record" wide ascii nocase /* E8 CC 11 00 00 call mw_rc4_decrypt 6A 55 push 85 ; cchLocaleName 8D 8D 1C FF FF FF lea ecx, [ebp-0E4h] 89 45 D8 mov [ebp-28h], eax A1 50 E0 4F 00 mov eax, GetUserDefaultLocaleName 51 push ecx ; lpLocaleName FF D0 call eax ; GetUserDefaultLocaleName 85 C0 test eax, eax 74 24 jz short loc_4F75B5 BE 00 E0 4F 00 */ $op1 = { e8 cc 11 00 00 6a 55 8d 8d 1c ff ff ff 89 45 d8 a1 50 e0 ?? 00 51 ff d0 85 c0 74 24 be 00 e0 ?? 00 } /* 8B 3D 90 E0 4F 00 mov edi, lstrlenW 8B DA mov ebx, edx 53 push ebx ; lpString 89 4D FC mov [ebp+lpString], ecx FF D7 call edi ; lstrlenW FF 75 FC push [ebp+lpString] ; lpString 8B F0 mov esi, eax FF D7 call edi ; lstrlenW 8B 0D 48 E0 4F 00 mov ecx, LocalAlloc 8D B8 80 00 00 00 lea edi, [eax+80h] 03 FE add edi, esi 8D 04 3F lea eax, [edi+edi] 50 push eax ; uBytes 6A 40 push 64 ; uFlags FF D1 call ecx ; LocalAlloc */ $op2 = { 8b 3d 90 e0 ?? 00 8b da 53 89 4d fc ff d7 ff 75 fc 8b f0 ff d7 8b 0d 48 e0 ?? 00 8d b8 80 00 00 00 03 fe 8d 04 3f 50 6a 40 ff d1 } condition: uint16(0) == 0x5a4d and filesize < 5000KB and ((2 of ($s*)) and (all of ($op*))) }
rule win_recordbreaker_w1 { meta: description = "detect_Raccoon_Stealer_v2" author = "@malgamy12" date = "16/11/2022" license = "DRL 1.1" hash = "0123b26df3c79bac0a3fda79072e36c159cfd1824ae3fd4b7f9dea9bda9c7909" hash = "0c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256" hash = "048c0113233ddc1250c269c74c9c9b8e9ad3e4dae3533ff0412d02b06bdf4059" hash = "89a718dacc3cfe4f804328cbd588006a65f4dbf877bfd22a96859bf339c6f8bc" hash = "516c81438ac269de2b632fb1c59f4e36c3d714e0929a969ec971430d2d63ac4e" hash = "0c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256" hash = "3ae9d121aa4b989118d76e8b0ff941b9b72ccac746de8b3a5d9f7d037361be53" hash = "bd8c1068561d366831e5712c2d58aecb21e2dbc2ae7c76102da6b00ea15e259e" hash = "960ce3cc26c8313b0fe41197e2aff5533f5f3efb1ba2970190779bc9a07bea63" hash = "bc15f011574289e46eaa432f676e59c50a9c9c42ce21332095a1bd68de5f30e5" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker" malpedia_rule_date = "20230118" malpedia_hash = "" malpedia_version = "20230118" malpedia_license = "DRL 1.1" malpedia_sharing = "TLP:WHITE" strings: $s0 = "\\ffcookies.txt" wide $s1 = "wallet.dat" wide $s2 = "Network\\Cookies" wide $s3 = "Wn0nlDEXjIzjLlkEHYxNvTAXHXRteWg0ieGKVyD52CvONbW7G91RvQDwSZi/N2ISm" ascii $op1 = {6B F3 ?? 03 F7 8B 7D ?? [3] A5} $op2 = {8A 0C 86 8B 45 ?? 8B 7D ?? 32 0C 38 8B 7D ?? 8B 86 [4] 88 0C 07 8B C7 8B 7D ?? 40} condition: uint16(0) == 0x5A4D and (all of them) }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY