MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0394a22e08728205b8068f3681368427668132e1d1405e5416e66b0241688538. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 3 File information Comments

SHA256 hash:	0394a22e08728205b8068f3681368427668132e1d1405e5416e66b0241688538
SHA3-384 hash:	d9a22167d90cbbd1c3c2e9e80ed5c54067bb7b28fce161a5f8cec7689737b535f6e0d7a792bcf975a4cd4ab7f37da22a
SHA1 hash:	bf9e060a43fdaeb4eca7511e54cc50fd249cc53b
MD5 hash:	51c33c00a3823180a7b39ab838542d9d
humanhash:	undress-beer-pip-august
File name:	51c33c00a3823180a7b39ab838542d9d.exe
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	245'720 bytes
First seen:	2022-08-18 06:50:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	671aa2c2e04d2049d50437e73dc464f9 (54 x RecordBreaker, 25 x RedLineStealer, 5 x Smoke Loader)
ssdeep	6144:LnClWVBGMHhMRz7E/jAO0qF+N4AwaZeOJ+B1aSHwmLk05QC:LnCEVB/Hd+NNZeOJW4SQmFQC
TLSH	T1F8347D0174E28872D53225350DE89AB65D3FF4740B7249FB37A99FFE4E242C3A720A65
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	abuse_ch
Tags:	exe recordbreaker

abuse_ch

RecordBreaker C2:
http://85.192.63.46/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://85.192.63.46/	https://threatfox.abuse.ch/ioc/843816/

Intelligence

File Origin

# of uploads :

# of downloads :

308

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

raccoon

ID:

File name:

51c33c00a3823180a7b39ab838542d9d.exe

Verdict:

Malicious activity

Analysis date:

2022-08-18 06:53:20 UTC

Tags:

trojan raccoon recordbreaker loader

Link:

https://app.any.run/tasks/e0743e2d-e2f3-4ca0-8925-34dc4170c112

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299512/

Detection(s):

SecuriteInfo.com.Trojan.Siggen18.36350.27309.6089.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for synchronization primitives

Сreating synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Sending a custom TCP request

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29373/overview

Behaviour

MalwareBazaar

MeasuringTime

CallSleep

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed smokeloader zusy

Link:

https://www.filescan.io/uploads/62fde1592093f7352868eb03/reports/a22ad4fd-72e2-4187-b29e-f077747282c3/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f7d085e-dae0-4913-9c32-c7248c258e8e

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1053602

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

DLL side loading technique detected

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0394a22e08728205b8068f3681368427668132e1d1405e5416e66b0241688538/

Threat name:

Win32.Trojan.Convagent

Status:

Malicious

First seen:

2022-08-18 06:51:07 UTC

File Type:

PE (Exe)

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aokkelqiokbaloagr43icnuee5ticmxb2faf4vaw4zvqeqliqu4a._file

Verdict:

malicious

Label(s):

raccoon

Result

Malware family:

n/a

Score:

8/10

Tags:

spyware

Link:

https://tria.ge/reports/220818-hmgtwsagel/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Loads dropped DLL

Downloads MZ/PE file

Unpacked files

SH256 hash:

33b4efeb6a4fe16524b6eb93deb7f796146c3e923b297b4b63b687873e5aa321

MD5 hash:

c4c2ab0f66c5695b766a5df2d9a0aeaf

SHA1 hash:

6b632ad424d8cad761b43f2c8989381bf7ddd151

Detections:

win_recordbreaker_auto

Link:

https://www.unpac.me/results/2db01cc9-227f-436c-94df-26e25e5b7170/

SH256 hash:

0394a22e08728205b8068f3681368427668132e1d1405e5416e66b0241688538

MD5 hash:

51c33c00a3823180a7b39ab838542d9d

SHA1 hash:

bf9e060a43fdaeb4eca7511e54cc50fd249cc53b

Link:

https://www.unpac.me/results/2db01cc9-227f-436c-94df-26e25e5b7170/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0394a22e0872/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0394a22e08728205b8068f3681368427668132e1d1405e5416e66b0241688538

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:	https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/