MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1617243bf260c15ffcb501df0b05d89af6f0590d1e779be89a53e56823f6e8b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1617243bf260c15ffcb501df0b05d89af6f0590d1e779be89a53e56823f6e8b7
SHA3-384 hash: 1a778e51e642c54108a38c824074554a65561a0f0fa29d4c581a6e81bb19cfd4bb7e1e6c724abfe838c09201cb294185
SHA1 hash: 853756a2af968f0e7c3cc08cbe8c7fc3a84b4b84
MD5 hash: 0d3585772dc70b510a5e7130395aec16
humanhash: batman-tennessee-fix-solar
File name:1617243bf260c15ffcb501df0b05d89af6f0590d1e779.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:7'320'576 bytes
First seen:2022-08-01 15:25:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0901266657d602fff9c7d9a865574642 (16 x RecordBreaker, 2 x RaccoonStealer)
ssdeep 196608:Yrdq/bytD/dxCjBRfGL9WnT18V9xZfaC7Y2:f/4XC9Rf+WT18THaC7T
TLSH T1E276233363090154D5D38D768223FDD472B62F6E8B816C7FB9FA78C935214A6E2A2D43
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4505/5/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 0862f2d8e974bc59 (1 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://193.43.147.159/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://193.43.147.159/ https://threatfox.abuse.ch/ioc/840936/

Intelligence

File Origin
# of uploads :
1
# of downloads :
373
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/295637/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27996/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62e7f107bcf76fcb6cd8a16b/reports/2b8e4a3f-78a0-4ed3-afe3-94f1709b1c26/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0bb566b1-d357-482e-8630-ab948ee611e2
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1044299
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1617243bf260c15ffcb501df0b05d89af6f0590d1e779be89a53e56823f6e8b7/
Threat name:
Win32.Trojan.RecordBreaker
Create hunting rule
Status:
Malicious
First seen:
2022-08-01 15:26:21 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cylsio7smdav77fvahpqwboytl3pawindz3zx2e2kpswqi7w5c3q._file
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:116656f21cff237d481d7a5666a100d3 discovery spyware stealer
Link:
https://tria.ge/reports/220801-st7c8sahf7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://193.43.147.159
Unpacked files
SH256 hash:
17481e251aeaf3b2bd7ed2a4d15882300f3a000949d5088f909a7c95f216f00a
MD5 hash:
6373a04c706328a471968d55af84a2f3
SHA1 hash:
00e8b6db957fdf4faed70f82d04e834f2dc29364
Link:
https://www.unpac.me/results/cd2f88ef-862e-408a-8a4c-3d402a1f52bf/
SH256 hash:
1617243bf260c15ffcb501df0b05d89af6f0590d1e779be89a53e56823f6e8b7
MD5 hash:
0d3585772dc70b510a5e7130395aec16
SHA1 hash:
853756a2af968f0e7c3cc08cbe8c7fc3a84b4b84
Link:
https://www.unpac.me/results/cd2f88ef-862e-408a-8a4c-3d402a1f52bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1617243bf260c15ffcb501df0b05d89af6f0590d1e779be89a53e56823f6e8b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/295637/

Comments