MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4
SHA3-384 hash:	467737a44c60394740082f4b6acc726d7d6e2e7eeb3c07629fb01689b6e660e94ceec287684d56e7dbc7052dc2a6928b
SHA1 hash:	d21a8c0a6eea7d6ae426cd1d9c1d3ff9e27d1032
MD5 hash:	e343dd965d4af13b6d8e966dd425a8cc
humanhash:	solar-twenty-neptune-neptune
File name:	e343dd965d4af13b6d8e966dd425a8cc.exe
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	305'152 bytes
First seen:	2022-09-11 14:05:50 UTC
Last seen:	2022-09-11 15:11:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3d9098454e0bda32871001353fdbb2f5 (1 x NetSupport, 1 x RecordBreaker)
ssdeep	6144:rDTZWDIbNAJIZMV3wFgBvaCFf0K8+iqRGXyF2qs7zPsnNx:rBWtBvlFf0K8QRG3qs7jC
Threatray	372 similar samples on MalwareBazaar
TLSH	T1F2549D00BB90C434F1B312F45ABA93A8B53E7EA05B6455CF62D956EE57346E0EC3131B
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	25ec1378319b9b91 (14 x RedLineStealer, 14 x Smoke Loader, 3 x RaccoonStealer)
Reporter	abuse_ch
Tags:	exe recordbreaker

Intelligence

File Origin

# of uploads :

# of downloads :

294

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

raccoon

ID:

File name:

e343dd965d4af13b6d8e966dd425a8cc.exe

Verdict:

Malicious activity

Analysis date:

2022-09-11 14:08:03 UTC

Tags:

trojan raccoon recordbreaker loader stealer

Link:

https://app.any.run/tasks/afd4f1c0-c9da-4147-8b83-94088682107b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RaccoonV2

Link:

https://www.capesandbox.com/analysis/309315/

Detection(s):

SecuriteInfo.com.Variant.Jaik.94865.25350.29380.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP POST request

Sending an HTTP GET request

Creating a file

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/631deb54d06d9bc4c7b9c66e/reports/e109248d-720b-418f-be4b-9826124c59ba/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c0815544-5182-42a8-a9e5-cab6ecbf5805

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1068473

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2022-09-11 09:56:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 26 (96.15%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d7kl6mcam5r44y5ywcca62b7ktjd76dwy3eo2gfncg6qp3xxipca._file

Verdict:

malicious

Label(s):

raccoon

RecordBreaker

6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92

RecordBreaker

7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4

RecordBreaker

8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771

RecordBreaker

829f67338d9165358ffdab748662e90f6f6962711dee0e670faacd61517d20ff

RecordBreaker

b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb

RecordBreaker

cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d

RecordBreaker

e3f6666bcc343098a21a2c52ee8a63d03c042b9dfd4cb1dfbf984c6d0e985da0

RecordBreaker

ef7f2a5348c23351c26390a636b47d35b3e236c47017e1ed95c112a87b783cf0

RecordBreaker

+ 362 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:567d5bff28c2a18132d2f88511f07435 discovery spyware stealer

Link:

https://tria.ge/reports/220911-redxpsfdhq/

Behaviour

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

Malware Config

C2 Extraction:

http://116.203.167.5/
http://195.201.248.58/

Unpacked files

SH256 hash:

a6b0212a9d82a6eaffcc7da8d53b0190c668e1aab7e1aa669280bc7b9c9340ba

MD5 hash:

0299baa991972658bed068fcce759338

SHA1 hash:

31b911f731ab3dd3ae9ed98e19ef5b06ed9a19a0

Detections:

raccoonstealer

win_recordbreaker_auto

Link:

https://www.unpac.me/results/a5d25462-1883-46c0-a72a-4119fc8e78a5/

Parent samples :

61e9483a13f0e4d906031e1db890424d3f7916710c80ba1d7da968f986fa9764
cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d
8324f3a58dbe3ba8a2e06f1fe56de5f0b195da302dd131e01fd51f7f6b77f635
a027bc1335ac781074822ce6092e3241a1177aafc27d14858677a4c7116a2c5f
8efaf5bcb4dd8909f6f923c1e59c126455c2ba722f6787e32db34eba7a87caf3
8a40814ff8c008d254cceccca174641b028284e498c20bfb5156dfeca935c10d
d9cc12873944b748796cf9c8c9bda46d0ae9eee43ac5b230b87600259ab9dc36
8c79af93b3497029228253bdf1f55696e07a24b9dba5adbc976764dcd18e78aa
570c8bfbfe83183e8cf87d989d2a0bee76da03f0db2061578629d3939a4a42f7
1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4
3dd554251ff82ea8e869a7b847623ea9faccbd9b99729ae298b2b76689641f41
cd7859e032cef757f88cc77006b3e0ba62514416eb279ff6e4978ebe157a5f9e
2e7fea68efd35999000bfa905124a0edd6f9c8db04017133ec62cddce9b787c4

SH256 hash:

1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4

MD5 hash:

e343dd965d4af13b6d8e966dd425a8cc

SHA1 hash:

d21a8c0a6eea7d6ae426cd1d9c1d3ff9e27d1032

Link:

https://www.unpac.me/results/a5d25462-1883-46c0-a72a-4119fc8e78a5/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1fd4bf304067/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.