MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
SHA3-384 hash: 0c7ca7cf1bf69670557ebd903833ed28a1625cb6a57ecd3238dc923c5c90fe597c776c4ddd6aab531f54416b2030baf0
SHA1 hash: 8bc40caa035804a6d99a09d34a1a9faa90ee78f0
MD5 hash: 3282ea72e2abbbf6b4150816461125a2
humanhash: oscar-victor-mississippi-friend
File name:Setup.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:6'819'795 bytes
First seen:2023-02-21 04:03:43 UTC
Last seen:2023-02-21 05:28:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 161839a78ef6f07a30d3f07895f6fe23 (27 x RecordBreaker)
ssdeep 196608:ppUI+/B0d1FOw1vGzZQ7Ey3aHczOBfmpLHe+VV:cI7bowozaQy3NzOcHeo
Threatray 37 similar samples on MalwareBazaar
TLSH T1F16622629371C078C8B8B87C4C267CA436F959567680B8B8BCD76CF3FA12450866E5DF
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 929eacb296aaaaaa (1 x RecordBreaker)
Reporter Chainskilabs
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
307
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
No threats detected
Analysis date:
2023-02-21 04:05:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/61b9a941-2ba2-4166-9193-73bcb3059868

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368544/
Detection(s):
SecuriteInfo.com.Variant.Lazy.268815.10715.28794.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/71902/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63f442b35dc36d906761c75b/reports/80545430-986c-4b10-8e5e-5206b1231514/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0bb34b95-b9a8-4a4d-ac35-0b2d0f106c42
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1179544
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Found potential ransomware demand text
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 812370 Sample: Setup.exe Startdate: 21/02/2023 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic 2->53 55 Multi AV Scanner detection for domain / URL 2->55 57 Antivirus detection for URL or domain 2->57 59 6 other signatures 2->59 7 Setup.exe 32 2->7         started        12 DesktopTemplates-tupe3.9.3.6.exe 2->12         started        14 DesktopTemplates-tupe3.9.3.6.exe 2->14         started        process3 dnsIp4 35 77.73.134.24, 49704, 80 FIBEROPTIXDE Kazakhstan 7->35 37 83.217.11.34, 49703, 80 ATLEX-ASRU Russian Federation 7->37 39 77.73.134.35 FIBEROPTIXDE Kazakhstan 7->39 27 C:\Users\user\AppData\Roaming\0PcAL536.exe, PE32+ 7->27 dropped 29 C:\Users\user\AppData\Local\...\ViD01D5l.exe, PE32+ 7->29 dropped 31 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 7->31 dropped 33 6 other files (4 malicious) 7->33 dropped 65 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->65 67 Tries to harvest and steal browser information (history, passwords, etc) 7->67 69 Tries to detect virtualization through RDTSC time measurements 7->69 71 Tries to steal Crypto Currency Wallets 7->71 16 0PcAL536.exe 1 3 7->16         started        20 ViD01D5l.exe 7->20         started        file5 signatures6 process7 file8 25 C:\...\DesktopTemplates-tupe3.9.3.6.exe, PE32+ 16->25 dropped 41 Multi AV Scanner detection for dropped file 16->41 43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->43 45 Machine Learning detection for dropped file 16->45 47 Creates autostart registry keys with suspicious names 16->47 22 DesktopTemplates-tupe3.9.3.6.exe 16->22         started        49 Antivirus detection for dropped file 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 signatures9 process10 signatures11 61 Antivirus detection for dropped file 22->61 63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->63
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd/
Threat name:
Win32.Infostealer.Lazy
Create hunting rule
Status:
Malicious
First seen:
2023-02-21 04:04:09 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
16 of 39 (41.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=grllhvzhc35glra5hnwy3xk6nq3fz64mp7jjrjl34xzqw3fpfdoq._file
Verdict:
malicious
Similar samples:
1ef0fe49cef266707c54468ea0113c06965f021ca19db32035d80007b6517c2b
RecordBreaker
37b90013b2b05efd0ff943fb6b3173bc802d5cc7eb0d24801ee5c298f30b5b3d
RecordBreaker
572ab8a858b7d9cfd33d6f140f43b4ae890ba62bd5fa3eb1dee16c184e8d921c
RecordBreaker
58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da
RecordBreaker
90e7c78ca1612b6f6e0f2c25e00e4c73e9df86936a243a03a488a3b155334eea
RecordBreaker
b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807
RecordBreaker
b7e70119bad5c9fcd84035b4b9064911f45f0e95a2ec4a84b0ee10105d541055
RecordBreaker
ceb3007d4015dd96043315cd91f6c4ff82da1b206921311c8833d76947e92702
RecordBreaker
d034c82de08e2aabe9f27089610a46d42fa741cfcaedec06a016810c660b402c
RecordBreaker
+ 27 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:f1c3f7a3e12da19758239f0284e7dc2c stealer
Link:
https://tria.ge/reports/230221-enhk2afd6t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Raccoon
Malware Config
C2 Extraction:
http://83.217.11.34
http://83.217.11.35
Unpacked files
SH256 hash:
3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
MD5 hash:
3282ea72e2abbbf6b4150816461125a2
SHA1 hash:
8bc40caa035804a6d99a09d34a1a9faa90ee78f0
Link:
https://www.unpac.me/results/45ecfa31-aa13-47d3-9cca-670e76a3d543/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3456b3d72716/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/368544/

Comments