MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b
SHA3-384 hash: 6174ef636747e73dc432ed6c080fec44c1c828ae794ffd9cf714ad7d33417e3313b74de02f1875b9d2f4a1698630ca27
SHA1 hash: 559cb7f7e402658a979f6fdf196a900eb94f605b
MD5 hash: 0859e9913321a2c77bd4c425e94cc9a2
humanhash: cold-august-grey-mirror
File name:Setup.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:6'950'867 bytes
First seen:2023-02-22 02:13:58 UTC
Last seen:2023-02-22 03:29:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 161839a78ef6f07a30d3f07895f6fe23 (27 x RecordBreaker)
ssdeep 196608:wy0w8mRdALuABSnzSdUbiEQt9nSXMojADLgO+xKN:yEMudzHOEQt0jsgOaKN
Threatray 36 similar samples on MalwareBazaar
TLSH T1EE6623632137514EE0F6853D402B7DA571F61F920E83987CB4EABED924728F5E307A92
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 34e4ccfcecf8e86c (4 x RecordBreaker, 1 x CryptBot)
Reporter Chainskilabs
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
264
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
No threats detected
Analysis date:
2023-02-22 02:13:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f4d9bbbb-5b54-442f-b353-cb4de52faafc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368783/
Detection(s):
SecuriteInfo.com.Variant.Lazy.252736.27438.15548.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72063/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63f57a6c01b99ad33e7f180b/reports/bd65a0d2-4343-44a1-b114-3cd5477899cd/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/782aa2f3-c185-49cd-afba-4375797f1f1c
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1180199
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 813030 Sample: Setup.exe Startdate: 22/02/2023 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic 2->53 55 Antivirus detection for URL or domain 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 4 other signatures 2->59 7 Setup.exe 34 2->7         started        12 regid.1991-06.com.microsoftUSOPrivate-tupe4.9.7.2.exe 2->12         started        14 regid.1991-06.com.microsoftUSOPrivate-tupe4.9.7.2.exe 2->14         started        process3 dnsIp4 35 83.217.11.34, 49699, 80 ATLEX-ASRU Russian Federation 7->35 37 77.73.134.24, 49702, 80 FIBEROPTIXDE Kazakhstan 7->37 39 77.73.134.35 FIBEROPTIXDE Kazakhstan 7->39 27 C:\Users\user\AppData\Roaming\Fn4vckC1.exe, PE32+ 7->27 dropped 29 C:\Users\user\AppData\Local\...\4d2lV69u.exe, PE32+ 7->29 dropped 31 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 7->31 dropped 33 6 other files (4 malicious) 7->33 dropped 65 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->65 67 Tries to harvest and steal browser information (history, passwords, etc) 7->67 69 Tries to evade analysis by execution special instruction (VM detection) 7->69 71 3 other signatures 7->71 16 Fn4vckC1.exe 1 3 7->16         started        20 4d2lV69u.exe 7->20         started        file5 signatures6 process7 file8 25 regid.1991-06.com....ate-tupe4.9.7.2.exe, PE32+ 16->25 dropped 41 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->41 43 Machine Learning detection for dropped file 16->43 45 Creates autostart registry keys with suspicious names 16->45 22 regid.1991-06.com.microsoftUSOPrivate-tupe4.9.7.2.exe 16->22         started        47 Antivirus detection for dropped file 20->47 49 Multi AV Scanner detection for dropped file 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 signatures9 process10 signatures11 61 Antivirus detection for dropped file 22->61 63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->63
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2023-02-22 02:15:10 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
18 of 25 (72.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dohyj47jjk65iz7dpfhdg3il5nu3yuwez32n54gihiaxe6jwhf5q._file
Verdict:
malicious
Similar samples:
3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
RecordBreaker
37b90013b2b05efd0ff943fb6b3173bc802d5cc7eb0d24801ee5c298f30b5b3d
RecordBreaker
5280df289219b64295e97b3b94e61b34e93a2fa9796067a447b7695499711e97
RecordBreaker
572ab8a858b7d9cfd33d6f140f43b4ae890ba62bd5fa3eb1dee16c184e8d921c
RecordBreaker
90e7c78ca1612b6f6e0f2c25e00e4c73e9df86936a243a03a488a3b155334eea
RecordBreaker
b7e70119bad5c9fcd84035b4b9064911f45f0e95a2ec4a84b0ee10105d541055
RecordBreaker
ceb3007d4015dd96043315cd91f6c4ff82da1b206921311c8833d76947e92702
RecordBreaker
d034c82de08e2aabe9f27089610a46d42fa741cfcaedec06a016810c660b402c
RecordBreaker
+ 26 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:e8079d22e46847399691305c53f6386c stealer
Link:
https://tria.ge/reports/230222-cnzs7sbc9w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Raccoon
Malware Config
C2 Extraction:
http://83.217.11.34
http://83.217.11.35
Unpacked files
SH256 hash:
1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b
MD5 hash:
0859e9913321a2c77bd4c425e94cc9a2
SHA1 hash:
559cb7f7e402658a979f6fdf196a900eb94f605b
Link:
https://www.unpac.me/results/ed4282f2-fdc5-4a45-9ffd-500cc5351408/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1b8f84f3e94a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/368783/

Comments