MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a
SHA3-384 hash: 83623222db0813fc3254a9dc8c7646898ef379a3e18d3418710e160c0ac0af76cf90a4547e04f2f84106f8b7e1f49725
SHA1 hash: 8eb25511507372ad5b406ef6c388dd600d7db33c
MD5 hash: f889728355383c7b24e108d34c30c86c
humanhash: solar-sixteen-three-zebra
File name:f889728355383c7b24e108d34c30c86c.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:849'824 bytes
First seen:2022-08-29 04:20:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48c28d9f3783f0e32815b0b4c57a60a9 (73 x RecordBreaker, 23 x RedLineStealer, 21 x ArkeiStealer)
ssdeep 24576:mqnG8N48Jz/YIrSK+gaZRlWx/jsYqGpEKRMCF:Rz/YIrb9yK+m
Threatray 112 similar samples on MalwareBazaar
TLSH T15B059E313DC08172EDE220B646ECF931457DE0B0072647CB56D85BEEEA646D16F3369A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
78.153.144.6:2510

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
78.153.144.6:2510 https://threatfox.abuse.ch/ioc/845912/

Intelligence

File Origin
# of uploads :
1
# of downloads :
276
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f889728355383c7b24e108d34c30c86c.exe
Verdict:
No threats detected
Analysis date:
2022-08-29 04:23:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cd0d0761-d966-4443-b940-4ba1e0e053cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301993/
Detection(s):
SecuriteInfo.com.Variant.Lazy.238286.26003.14727.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30627/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware mokes overlay packed
Link:
https://www.filescan.io/uploads/630c3f283e9e50b1bae6e6e5/reports/da1a0dcc-d6b5-4495-8a06-4e965df10230/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbd74450-2939-44d9-a936-9d19223b69ab
Result
Threat name:
PrivateLoader, Raccoon Stealer v2, RedLi
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1059481
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected PrivateLoader
Yara detected Raccoon Stealer v2
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 691998 Sample: BFpnh3Fvdt.exe Startdate: 29/08/2022 Architecture: WINDOWS Score: 100 81 ultra-cheat.ru.net 2->81 83 in.appcenter.ms 2->83 85 coinsurf.com 2->85 101 Snort IDS alert for network traffic 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 Antivirus detection for URL or domain 2->105 107 9 other signatures 2->107 10 BFpnh3Fvdt.exe 2->10         started        13 wuisrab 2->13         started        signatures3 process4 signatures5 109 Contains functionality to inject code into remote processes 10->109 111 Writes to foreign memory regions 10->111 113 Allocates memory in foreign processes 10->113 115 Injects a PE file into a foreign processes 10->115 15 AppLaunch.exe 10->15         started        18 WerFault.exe 23 9 10->18         started        21 AppLaunch.exe 10->21         started        23 AppLaunch.exe 10->23         started        process6 file7 141 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->141 143 Maps a DLL or memory area into another process 15->143 145 Checks if the current machine is a virtual machine (disk enumeration) 15->145 147 Creates a thread in another existing process (thread injection) 15->147 25 explorer.exe 12 15->25 injected 57 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->57 dropped signatures8 process9 dnsIp10 95 ilab2478jdshd.xyz 25->95 97 belladama.fr 207.174.214.200, 443, 49788, 49792 PUBLIC-DOMAIN-REGISTRYUS United States 25->97 99 7 other IPs or domains 25->99 73 C:\Users\user\AppData\Roaming\wuisrab, PE32 25->73 dropped 75 C:\Users\user\AppData\Local\Temp\8FCB.exe, PE32 25->75 dropped 77 C:\Users\user\AppData\Local\Temp\753D.exe, PE32 25->77 dropped 79 3 other files (2 malicious) 25->79 dropped 123 System process connects to network (likely due to code injection or exploit) 25->123 125 Benign windows process drops PE files 25->125 127 Performs DNS queries to domains with low reputation 25->127 129 3 other signatures 25->129 30 45FE.exe 25->30         started        33 8FCB.exe 25->33         started        35 5C75.exe 25->35         started        37 3 other processes 25->37 file11 signatures12 process13 file14 131 Writes to foreign memory regions 30->131 133 Allocates memory in foreign processes 30->133 135 Injects a PE file into a foreign processes 30->135 40 AppLaunch.exe 18 30->40         started        45 WerFault.exe 30->45         started        137 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 33->137 47 AppLaunch.exe 33->47         started        139 Machine Learning detection for dropped file 35->139 49 AppLaunch.exe 35->49         started        51 WerFault.exe 35->51         started        59 C:\Users\user\AppData\Local\...\Update.exe, PE32 37->59 dropped 53 Update.exe 7 37->53         started        55 AppLaunch.exe 37->55         started        signatures15 process16 dnsIp17 87 t.me 149.154.167.99, 443, 49793 TELEGRAMRU United Kingdom 40->87 89 transfer.sh 144.76.136.153, 443, 49815 HETZNER-ASDE Germany 40->89 93 2 other IPs or domains 40->93 61 C:\ProgramData\91543586060989175144.exe, PE32 40->61 dropped 117 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 40->117 119 Tries to harvest and steal browser information (history, passwords, etc) 40->119 121 Tries to steal Crypto Currency Wallets 40->121 63 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 45->63 dropped 91 46.249.58.152, 49819, 80 SERVERIUS-ASNL Netherlands 47->91 65 C:\Users\user\AppData\...\vcruntime140.dll, PE32 47->65 dropped 67 C:\Users\user\AppData\LocalLow\nss3.dll, PE32 47->67 dropped 69 C:\Users\user\AppData\LocalLow\msvcp140.dll, PE32 47->69 dropped 71 C:\Users\user\AppData\Local\...\Update.exe, PE32 53->71 dropped file18 signatures19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 04:21:09 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7ptp35dhnzayjopuzp2i6lin4f56ibgtc4dkgfgncdobndbveva._file
Verdict:
malicious
Similar samples:
0a9a86d87da4b6984d7c09566b49776e41a3445aafbb1e4496925131e53b9aff
RecordBreaker
2f780fbe426ec668667aaa54a902cfab80f47cc1e3ef39017ef15845279384db
RecordBreaker
4ab91c72d0d913c2a18a74a2b9ea5bcd8b77bfb68110e56767a552a358fa0687
RecordBreaker
50b87ee5a6cb9ee5b9a40a7fe5adb1f807c3876f7499565f3f8754537945174e
RecordBreaker
6a56ad7cc45d701696652e3be5275f37f09527ecd7fdacbbf634b2532f97027a
RecordBreaker
8a3fbe98382adc07249d50db1aab8377b9587018be3598ef35cfc5d35495519a
RecordBreaker
8acf3d9eea531ae8c1ab8eabe3f22206f3771c6c25ed577a6c0010b0a43cfcc0
RecordBreaker
e591b90146b4483163c89abfb8186c2cb3612419210b995d44da912a0edbb3f5
RecordBreaker
e6173a0a906d3259d4a9006b61901262705e309a6e5bc1cdfc035e3a78e2f225
RecordBreaker
f8fbc50db8de41fbcf7dcf31883c086b50d0cc74fbbd94979893fc26c9898f76
RecordBreaker
+ 102 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220829-eym89sbcgj/
Unpacked files
SH256 hash:
412723a3d9295cf6e564e10c1e75642bdd82cbd161ffa9153562edb1a60be12d
MD5 hash:
30206da27efa9add6fc43c102e811b5d
SHA1 hash:
5b950f382a52bf91b5054565402a351b78d6b04f
Detections:
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/797e4c19-fbd1-41f2-aeac-bdc5d9d71029/
Parent samples :
b5938ac3434dba249dd144d180b2d9d1fae0918b81630497c458781acd3afed8
12d0f4e279c8b87d94fba44d8e4a85c553cd96b90256716bd98096ca4c2ba359
a70beb61ac3aa68ed844f8bf3a5c9ada717363fc372948c2ef88abb647665f39
38499e2889590574aa401acf16f8aba05e693e3da4aa0ac6e71f5d690446d29e
765e9affe3a441bbb4e9eb26ff339622cfaea0b027451f1203a260ce2064c3f9
7a1e4107599b275852d1353c20e84e2cfff2bd25c862d78a13937906a7e3709b
ef21ae74a71b4723917307e94623bea6f6bab6786c44f4a1a6ac6dc85b8840a5
9112a7346d78a2ae8877aa00b74654c6d09247b3db7fff02c78dc11235ce37f8
cb2564dcfdc61a2ea6154055a1bd85adc99b6161e93d87a6bc6770a67528c810
b9e95b6fa3070fb53792cb09341e8f2e62a1bd129303b238a94928d39ca0071b
fc2e70d71b95648d7877ff7122a5f495907c0001ba18f62ad99ac5a189af2053
9dd0e772737b8d16a0cdb8b201469b6e615665bdd377469f0e5f93b9ba8ac479
aa242d4c8a5f67afd47de854a31bb5bdc7d26a56341561b0651a4084e89849a8
fd3c3fae617c274ad21ce3dd7ed5bd7917f1cc4c05c3e2eb7970bc4a13e5f677
fd582f2eac99165e184680af6cad7a54bc49be0d81062a84a8b7ed89c6264d54
0d932c75aaa05e080f148244d3bb662f029700d0f93db45016bc7e832f4ec97b
9d2e0af3b8bff569350605fdb9a8b335e0927c3a79ead19e0e22b68be9485fed
0a4440a7a52617208ec855783b6d8c3f463cf252f55daabb91e1f077f7851147
7e1e6f593554832937d7ba69b5621c2cf62b0dee645af38d135ca87b8af41fe6
e6377f8eab328be9e7e44ab527745930e2e7f2c5bbd12002e8bbd067d433c554
6bec1b0031afd498aa61e08c7862bc1bc1a8b4a5dc431af109fc8fa5928d39da
d7b4d2dc55f5cccd3c78faa681a66bb34410844b1b489871013019fd3a0a592d
6ed7bcd055c39d73d9931abe8e3c72dd5eedc515abe2f804d6eafde208a69e71
5354e8f3b71a8fc97815eeb1ce7378fac5f5904c4fbd4a2e54f2a514746746c7
df590bceb693fc56770c4d38593029a55a9089861fdf9dc16d66a28e9937538e
8744d5d03a50bd12d9f320c679627121b728e51c8c0ea910c3cf52bb8ebe4feb
96cfa1aafa0804caebf3a76d0347e1c56c11f52521f5a179ddaa020d0a46232a
cdb1f87be3ee96364adc1444b3de9bc977fbf27042b58b72485341582c3d640d
03ea60a4f8df4d94d2f60eb4c1210d5148a1839e63d2c6f7b3a5a1e7e84cafc7
da59303921279f64f59348a35a80762786083649b8f14571a384bf20c058ea7a
e365896c10dc579e90035a614ceba996bdf1aa6d81cc054ae357979cf4d9998f
6a56ad7cc45d701696652e3be5275f37f09527ecd7fdacbbf634b2532f97027a
9c8c0c8e368d5895d29bb917517bab1bd71e529adfbd6e7c1619774c05bc0594
8acf3d9eea531ae8c1ab8eabe3f22206f3771c6c25ed577a6c0010b0a43cfcc0
4ab91c72d0d913c2a18a74a2b9ea5bcd8b77bfb68110e56767a552a358fa0687
50b87ee5a6cb9ee5b9a40a7fe5adb1f807c3876f7499565f3f8754537945174e
0a9a86d87da4b6984d7c09566b49776e41a3445aafbb1e4496925131e53b9aff
2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a
6cf78b1a3c0e8cefa95e5dc162d7442cca568a2a2e7811b32afafe74803b98ff
821cddea41336dfd788ff78d2fff14a722a1c8f7edcbbbfbbf482944561c6b07
599453ebb82c1cfffdc6201d416d3a0630a3a6b4429abfa230569d0aed8d03f3
6e3d020b3bd3c611a7350f59e1e41ceabbe573e1db4c640fe5217fd6d0d6ee38
eb472ba48f692c86a35dda96d6fbbfbdcc47ae1431b43824fdf56b44a2078bde
225e63ba68c765b44f6019a5d0727887d9bbadde4db669657cf37fc9e30ec262
50a1010ec34a0d592bc15f19dd572840813fbd8eeb32afc0715e88668732bd36
4e7a0319d1ef9a6bb3a1c8c55890053008305ce163f8aed0e3d723cea0386556
1c6b2e06ec61636fa0ed64a73c3bd037005bf37a832bf3c2d0be67ef82573443
SH256 hash:
2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a
MD5 hash:
f889728355383c7b24e108d34c30c86c
SHA1 hash:
8eb25511507372ad5b406ef6c388dd600d7db33c
Link:
https://www.unpac.me/results/797e4c19-fbd1-41f2-aeac-bdc5d9d71029/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2fdf37efa33b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 2fdf37efa33b720c25cfa65fa479686f0bdf202698b83518a66886e0b461a92a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2281065/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/301993/

Comments