MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788
SHA3-384 hash: 8f1a1d1d8683f998e99664e63d527a42b117f80968dbf4bc04b35c1e37eb969cb096c7b4bf85d3d078f6ecccc35053ad
SHA1 hash: 968615f24e34042148ec79fde65225f072fa46d9
MD5 hash: 1c79ebc079aaa45b861e584094dbeaf8
humanhash: golf-may-paris-nebraska
File name:1c79ebc079aaa45b861e584094dbeaf8
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:91'136 bytes
First seen:2023-01-23 19:02:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 52982bbab8b9d5eafbb4ec438626f86a (66 x Amadey, 1 x RecordBreaker)
ssdeep 1536:to4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU5gaB89p:toUCWbBNpplToUs1uNhj25LJUaaB89p
Threatray 27 similar samples on MalwareBazaar
TLSH T14E936B1030D2C071D57E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter zbetcheckin
Tags:32 dll exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/356063/
Detection(s):
SecuriteInfo.com.Trojan.Generic.33050756.3663.21034.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63ced9e6447edb203a006f74/reports/f6d16faa-c038-4e36-9e9c-1b310be882ce/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9240e3b4-7cff-452f-8757-03221da938de
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1157386
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 790123 Sample: EcHjV5UVl5.dll Startdate: 23/01/2023 Architecture: WINDOWS Score: 48 19 Multi AV Scanner detection for submitted file 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        13 rundll32.exe 7->13         started        15 5 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eyv2ebx4wmvjsfia26ljvxqyr6oy65s3j2wtust4bx4l64tmg6ea._file
Verdict:
malicious
Similar samples:
030dc76b0d91e614471cccc662fc799b8fb0486a249938231f07b497284de86e
RecordBreaker
0ce7bf97ed9da604c662a9337678ac0bf91ed1d4a17f2a939392c3bafbb319ee
RecordBreaker
1c15288c8df9551330c93dc786b2783fdd096dbe87e289315f8475d0e78e5928
RecordBreaker
33520cb1209409f60c2feb681777e52f315152ff2f14af1c59e7001b0c21f945
RecordBreaker
75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
RecordBreaker
7d7d804c89f40fc1198bd31b664271995f15f578642b91015939c0a698dedf5d
RecordBreaker
b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
RecordBreaker
e10013c1610befd6ba09dbbc264579d94a7e3815eb99a643636ea259d484f454
RecordBreaker
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230123-xqdzqseh25/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788
MD5 hash:
1c79ebc079aaa45b861e584094dbeaf8
SHA1 hash:
968615f24e34042148ec79fde65225f072fa46d9
Link:
https://www.unpac.me/results/1a7fb0f3-98ff-4fb0-a326-29896c67ff9a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

DLL dll 262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2516464/
Cape
Cape
https://www.capesandbox.com/analysis/356063/

Comments


Avatar
zbet commented on 2023-01-23 19:02:15 UTC

url : hxxp://62.204.41.27/9djZdj09/Plugins/clip64.dll