MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 3 File information Comments

SHA256 hash:	207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808
SHA3-384 hash:	1fe0657d2d690a44f78df767114eb2d5ad090d868870ed4e8aef05db5a982295f47def6972d98b3aed5d598ea4b9551f
SHA1 hash:	0e531be2d6b033d6815b0a99936eee3e71c0957e
MD5 hash:	9ada77c88a94e41eee864da009b0cf1a
humanhash:	mars-twelve-twelve-undress
File name:	9ada77c88a94e41eee864da009b0cf1a.exe
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	245'720 bytes
First seen:	2022-08-17 19:30:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	671aa2c2e04d2049d50437e73dc464f9 (54 x RecordBreaker, 25 x RedLineStealer, 5 x Smoke Loader)
ssdeep	6144:DfxlWlpgUXRkxzjEPjAOIF01rysJhVZQC:DfxklpJHZDj/QC
Threatray	156 similar samples on MalwareBazaar
TLSH	T18A348D8170F3C272E472313205E4EFB5693DF4654F6989FB27892B7E4E342C1CA2566A
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	abuse_ch
Tags:	exe recordbreaker

abuse_ch

RecordBreaker C2:
http://85.192.63.46/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://85.192.63.46/	https://threatfox.abuse.ch/ioc/843816/

Intelligence

File Origin

# of uploads :

# of downloads :

283

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

raccoon

ID:

File name:

9ada77c88a94e41eee864da009b0cf1a.exe

Verdict:

Malicious activity

Analysis date:

2022-08-17 20:56:16 UTC

Tags:

trojan raccoon recordbreaker loader stealer

Link:

https://app.any.run/tasks/a43dbbb2-dbe7-46e4-9cda-97062012a343

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299380/

Detection(s):

SecuriteInfo.com.W32.SmokeLoader.C.genEldorado.32248.22852.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for synchronization primitives

Сreating synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Sending a custom TCP request

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29293/overview

Behaviour

MalwareBazaar

CallSleep

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed smokeloader wacatac

Link:

https://www.filescan.io/uploads/62fd41ff2093f73528665cb8/reports/52987db9-c2da-4aae-82b9-cd1f4002d154/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e164fc6f-03fa-4235-b0a1-33eb9b9c8ed7

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1053326

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

DLL side loading technique detected

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808/

Threat name:

Win32.Trojan.Convagent

Status:

Malicious

First seen:

2022-08-17 19:31:07 UTC

File Type:

PE (Exe)

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ebzfmrsosh66ji22vur2pjlo7h4uhdgt56kgighw4bvabzynpaea._file

Verdict:

malicious

Label(s):

raccoon

RecordBreaker

76b0ba4ab1eecf85812948358e917f8d255f073c401ff504516128065c8ce805

RecordBreaker

9784234158283ec0b873fa2d3c5259fc92d99c9b84d9d96c1994b8777d11e04b

RecordBreaker

adef4ddb07e0ed81129a662c8c1d2d9083bafd0f112e55ca46586381edd70cb9

RecordBreaker

ae0463fdfa74a765da29ccd5e9e9f27bac9b5ccc4ecbda5ea8d942e5fe387a99

RecordBreaker

b0c8efac139f940f344d3d707603c86c3418ff8e45005870e50009a9720af5e4

RecordBreaker

c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4

RecordBreaker

d11cb197027626f1e962152d0331552e3deffc6b7272c8fbba8e2ede242abb64

RecordBreaker

eb6b1b9f09b85071216997ab608a8fa3fe45e7f8840dec8417a17133140a9ac5

RecordBreaker

f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c

RecordBreaker

+ 146 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

spyware

Link:

https://tria.ge/reports/220817-x8cvdsegd5/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Loads dropped DLL

Downloads MZ/PE file

Unpacked files

SH256 hash:

e6e7eb3f18f943df9fcf72d61e3fc91c0f9489d8d7b85eb593e812ab394d0e63

MD5 hash:

7bf91fd335c1c886f0576083ba02f33a

SHA1 hash:

13fff81d02d5eb87ee272dc9cc96e5520b9bf521

Detections:

win_recordbreaker_auto

Link:

https://www.unpac.me/results/0494902b-5a02-4506-bab6-dcf4a4122678/

Parent samples :

207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808
f60a77d85331ea1e3327e414cdb5c03ceedb7d6d2c084b3c2fefc0141f95a704

SH256 hash:

207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808

MD5 hash:

9ada77c88a94e41eee864da009b0cf1a

SHA1 hash:

0e531be2d6b033d6815b0a99936eee3e71c0957e

Link:

https://www.unpac.me/results/0494902b-5a02-4506-bab6-dcf4a4122678/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/207256464e91/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/207256464e91fde4a35aad23a7a56ef9f9438cd3ef946418f6e06a00e70d7808

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:	https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/