MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 16


Intelligence 16 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e
SHA3-384 hash: 9a08e708a5333f9e8b9738b81daf647e553bab1c10fbcbd788cacd80817ecfe8b08d248fc57b684b70ea678cad92b312
SHA1 hash: 3422cdb2a04b2c7813c5e8c7bdde2d4adee4fe6a
MD5 hash: 0d7dc488783398eaa102f93025965816
humanhash: nebraska-lima-lima-maryland
File name:0d7dc488783398eaa102f93025965816.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:7'791'616 bytes
First seen:2022-10-23 08:15:46 UTC
Last seen:2022-10-23 09:05:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 55b10b9a68cf4c9445f709a0442d415e (6 x RecordBreaker)
ssdeep 196608:5bXsxIZ7tIJ+jdMtA60veRKQNBuknt0P1:5LsxIQIa+60wmkneP1
Threatray 749 similar samples on MalwareBazaar
TLSH T1167623A72360055AF4A58C36C5177DA732F2427B4B829CBC05EFFEC526326B5A206F53
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00e00360b8ee6cb0 (1 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://89.22.226.85/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://89.22.226.85/ https://threatfox.abuse.ch/ioc/915995/

Intelligence

File Origin
# of uploads :
2
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
0d7dc488783398eaa102f93025965816.exe
Verdict:
Malicious activity
Analysis date:
2022-10-23 08:16:30 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Link:
https://app.any.run/tasks/5af089f2-2cc7-4134-99ea-bc339f5a4a5b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/322898/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62897605.24369.31597.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/44642/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6354f845898b0652a4b96f2f/reports/bb49f2ee-8bc9-470a-995e-58fa32775e59/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/acf5281c-8370-40cc-83a0-f182f6dfe8ce
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1095806
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Suspicious
First seen:
2022-10-18 15:09:00 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
26 of 42 (61.90%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gu2p2c3bppqzx4sptn77d2mkwi5zrlxubo6cie2vjjhmlyawtf7a._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
1e5c7dcfbe4a1e9da06229b4512229c463b0268832b9cb6cdb35a1153963be37
RecordBreaker
37af8d63e8e5adb5a5f30b471fe4e29f686c7923507583a21f46d3b2eb554f09
RecordBreaker
43b95532737d0ccc0b957d1ab3e6ba4310b4618eec3fa485736b8f0a35cb157c
RecordBreaker
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172
RecordBreaker
4e73230986aab0ad40dbd475ca56fe0f207ff5d935f766a46cd4675e6bc27229
RecordBreaker
53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9
RecordBreaker
595a5d21b386ba8e30b567cbe575b24ed104ee589037a48aa2d277452ba0b6a6
RecordBreaker
81ae7aea498cdd4d50470b3dcd54088d7bce5bf5f6019b08d9d558acd190cb4d
RecordBreaker
+ 739 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:3e9f438d0c4d94a7342d466691639d7c stealer
Link:
https://tria.ge/reports/221023-j55jcahcc5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Raccoon
Malware Config
C2 Extraction:
http://89.22.226.85/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fbc1b7b4-f071-4d4c-8131-f0e25d7c97a2
Unpacked files
SH256 hash:
bb4b46bcd35aa40fb42aeb54741bdc03b04812019e63f3cdcfc60203c986bb76
MD5 hash:
63f0375db8035a82aa8933913e0fdcb6
SHA1 hash:
69335419cae146b85d99b28327a325bc8a5656a4
Detections:
raccoonstealer
Create hunting rule
Link:
https://www.unpac.me/results/ac0f4b0b-042c-41e5-bc0c-641a1abe4823/
SH256 hash:
3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e
MD5 hash:
0d7dc488783398eaa102f93025965816
SHA1 hash:
3422cdb2a04b2c7813c5e8c7bdde2d4adee4fe6a
Link:
https://www.unpac.me/results/ac0f4b0b-042c-41e5-bc0c-641a1abe4823/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3534fd0b617b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/322898/

Comments