MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2
SHA3-384 hash: c975c15185ffc6f31b8d8039de57f65a95e0359a43d5d216398c482fc10708e8ebb31149ddf0c71248bc60f3f936b99d
SHA1 hash: 72ddfd7b2be3c8c0f8ef61024c815f6bf9c89291
MD5 hash: 86f5fc4c4e892540dd55816b592e6acc
humanhash: robin-robert-rugby-helium
File name:file
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:692'512 bytes
First seen:2023-01-29 21:22:19 UTC
Last seen:2023-01-29 21:36:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:28BR8ZROp7Z9Go5k25A0qkVUtNB22/+qaSaLMJfTE6EpcK:2e4o7G0k2bVUtNB523rSTE6Yj
Threatray 1'018 similar samples on MalwareBazaar
TLSH T16CE4D037327F4281C37859BE831E5955E66D0D5E77A98A4F4900B992C6F2FC0082EF6B
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon f0d8c6c2e6f498e8 (1 x RecordBreaker)
Reporter andretavare5
Tags:exe recordbreaker signed

Code Signing Certificate

Organisation:HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 5036Mb 2.5 Rtl
Issuer:HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 5036Mb 2.5 Rtl
Algorithm:sha1WithRSAEncryption
Valid from:2023-01-22T13:34:17Z
Valid to:2033-01-23T13:34:17Z
Serial number: 16d0dcaf4f7cf2a84c76426982567240
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 3cd8623163242fb157ed1a9c05d275f0648e82cfd30b8218cf66537536635edf
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://77.73.134.27/races.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-29 10:25:04 UTC
Tags:
trojan amadey kelihos loader evasion stealer
Link:
https://app.any.run/tasks/ee8f661c-81e7-4311-9657-3620d7fd543f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/358030/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Sending an HTTP POST request
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63d6e3b789bd67c10fdb56ab/reports/bbc36fb9-0c70-426c-b86f-0e70798f5557/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/afa615c6-b35a-46d2-a37e-6ec334571c20
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1161174
Signature
.NET source code contains very large array initializations
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
DLL side loading technique detected
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
PE file has a writeable .text section
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Raccoon Stealer v2
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 793911 Sample: file.exe Startdate: 29/01/2023 Architecture: WINDOWS Score: 100 87 Snort IDS alert for network traffic 2->87 89 Multi AV Scanner detection for domain / URL 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 11 other signatures 2->93 9 file.exe 3 2->9         started        13 WlndowsDraiver-Ver4.6.0.0.exe 2->13         started        process3 file4 63 C:\Users\user\AppData\Local\...\file.exe.log, CSV 9->63 dropped 95 Writes to foreign memory regions 9->95 97 Injects a PE file into a foreign processes 9->97 15 AddInProcess32.exe 26 9->15         started        20 AppLaunch.exe 9->20         started        22 vbc.exe 9->22         started        24 aspnet_state.exe 9->24         started        99 Antivirus detection for dropped file 13->99 signatures5 process6 dnsIp7 73 94.131.3.70, 49718, 80 NASSIST-ASGI Ukraine 15->73 75 77.73.134.24, 49719, 80 FIBEROPTIXDE Kazakhstan 15->75 77 77.73.134.35 FIBEROPTIXDE Kazakhstan 15->77 55 C:\Users\user\AppData\Roaming\m3889367.exe, PE32+ 15->55 dropped 57 C:\Users\user\AppData\Roaming\lVN283yI.exe, PE32+ 15->57 dropped 59 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 15->59 dropped 61 6 other files (4 malicious) 15->61 dropped 79 Tries to harvest and steal browser information (history, passwords, etc) 15->79 81 DLL side loading technique detected 15->81 83 Tries to steal Crypto Currency Wallets 15->83 85 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 15->85 26 m3889367.exe 3 15->26         started        30 lVN283yI.exe 15->30         started        file8 signatures9 process10 dnsIp11 65 C:\...\WlndowsDraiver-Ver4.6.0.0.exe, PE32+ 26->65 dropped 101 Antivirus detection for dropped file 26->101 103 Multi AV Scanner detection for dropped file 26->103 105 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 26->105 109 2 other signatures 26->109 33 icacls.exe 1 26->33         started        35 icacls.exe 1 26->35         started        37 schtasks.exe 1 26->37         started        39 icacls.exe 1 26->39         started        67 youtube-ui.l.google.com 172.217.168.46 GOOGLEUS United States 30->67 69 192.168.2.1 unknown unknown 30->69 71 www.youtube.com 30->71 107 Tries to harvest and steal browser information (history, passwords, etc) 30->107 41 cmd.exe 1 30->41         started        file12 signatures13 process14 process15 43 conhost.exe 33->43         started        45 conhost.exe 35->45         started        47 conhost.exe 37->47         started        49 conhost.exe 39->49         started        51 conhost.exe 41->51         started        53 choice.exe 1 41->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2/
Threat name:
ByteCode-MSIL.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 22:11:24 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
13
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bq2gxbsxva2kknsxl64cu2464n6hhbkh7mxe32bbsf6zcmpmh7ra._file
Verdict:
malicious
Similar samples:
28ff484ca36b3a1f5d7f59a25e947e9a6b12ca34214f9bcfca01cee5745e6b6a
RecordBreaker
2c18cc487d7d1078460dce7e68108cb99eab6cb9ee1955ca4df3b2376f0a0e8b
RecordBreaker
30a61130c89f5bf2959ac994f6a904687abe5337c74501e4be4407ebd39ce0ec
RecordBreaker
41d58a31e2befb91705b4630f2cc48bfe9c09d5c26aee2034e5279b7bb314f4c
RecordBreaker
4795e398d5dce733ecb352580be08b33ae668684856a5cf34a8cc21fa303c60e
RecordBreaker
914e09b5e1bee2e3bbb2d77f8fae1a8069f67b887f6abf9c5785e9fc5e39dd1c
RecordBreaker
9fc4e8deaf8ebad6cc98b3816da653131fd48430a8585176210afe5c622c6d93
RecordBreaker
edd4c28b27289b8154d0cb6a487abef68f79087f554b02eace45e4ee8dd95325
RecordBreaker
+ 1'008 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:04f8fa0bf52b1b98a127f6deeac54f84 spyware stealer
Link:
https://tria.ge/reports/230129-z8fmdseg3t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Downloads MZ/PE file
Raccoon
Malware Config
C2 Extraction:
http://94.131.3.70/
http://83.217.11.11/
http://83.217.11.13/
http://83.217.11.14/
http://45.15.156.222/
Unpacked files
SH256 hash:
0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2
MD5 hash:
86f5fc4c4e892540dd55816b592e6acc
SHA1 hash:
72ddfd7b2be3c8c0f8ef61024c815f6bf9c89291
Link:
https://www.unpac.me/results/f8e7aaa4-58a9-4ad1-b713-db5dedb70257/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c346b8657a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2518982/
Cape
Cape
https://www.capesandbox.com/analysis/358030/

Comments