MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
SHA3-384 hash: 56880e4157c7dd4072984f297a4bd7433a7b4e4da9483c81a188f5742044832a633173441e1c142e048a4d830011ecb0
SHA1 hash: 36aafa923538fe316bc9bd5073c458efceccc6f4
MD5 hash: ec17160dd77d392a5bca4688aa3589ff
humanhash: green-montana-fix-violet
File name:0a1d548fb9debe4346fc13c05be5ace9b7429318fe222.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:554'912 bytes
First seen:2022-08-27 16:15:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b82b0468d2de138092bb342ea80f445 (14 x RecordBreaker, 12 x ArkeiStealer, 11 x RedLineStealer)
ssdeep 12288:mCeyDS0NtesQEDag1OEEpsL5T8euvyywiU3gOgsQqr:I9g1OEEm5T8YnZg0r
Threatray 377 similar samples on MalwareBazaar
TLSH T19DC47C1078E08933DDF220FA06EDB531856DA4F00B156ADB53C90BFAE6642E17F3659B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://filetick.pro/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://filetick.pro/ https://threatfox.abuse.ch/ioc/845696/

Intelligence

File Origin
# of uploads :
1
# of downloads :
352
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
0a1d548fb9debe4346fc13c05be5ace9b7429318fe222.exe
Verdict:
Malicious activity
Analysis date:
2022-08-27 16:16:26 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/bf86bd0a-4d78-4c0a-979c-2dfd2e5992a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301648/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30348/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630a4349f205e2ee767e1d66/reports/460c6064-fe7d-499c-9b8a-1e130a0511ca/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c5fd4a80-1a66-4c6a-a369-4e86811ef45c
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1058969
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b/
Threat name:
Win32.Infostealer.Bandra
Create hunting rule
Status:
Malicious
First seen:
2022-08-27 15:50:51 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=biovjd5z327egrx4cpafxznm5g3ufeyy7yrcrqqx3uqmurkc4mvq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
502e941d65f743b781b0214c9c37b8d4cca4b27fa7d62be943a63a9de93812d3
RecordBreaker
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
RecordBreaker
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
RecordBreaker
7c08ff1bd686c7c8913115c92319b59badc4dbc116a6630419440828141203fe
RecordBreaker
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
RecordBreaker
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
RecordBreaker
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
RecordBreaker
c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4
RecordBreaker
d7b364b3054f74a5e624e6abf2ca24bf91833a4fb4f437ce5601b12a4a214438
RecordBreaker
f3ad5816ebb2ce9d1d4e6a864b3d0548490392c2387e7b2655d7f2edfed7da69
RecordBreaker
+ 367 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220827-tqslcaeag8/
Unpacked files
SH256 hash:
c3dde04158ea53fd8c3856590f2d94969161d5bf0d149307085906c522158fa8
MD5 hash:
e35df5d7436028a402c1fd2e8e5e86cd
SHA1 hash:
4c54d3dc9dc6002696b18c77902297ccc60a4099
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/392f486e-427f-4058-921a-0ac04d1dec39/
Parent samples :
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e
SH256 hash:
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
MD5 hash:
ec17160dd77d392a5bca4688aa3589ff
SHA1 hash:
36aafa923538fe316bc9bd5073c458efceccc6f4
Link:
https://www.unpac.me/results/392f486e-427f-4058-921a-0ac04d1dec39/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/301648/

Comments