MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
SHA3-384 hash: 3c696bfcc2b69e9291a6320ad416567edfbba8f6b2f90d77e71bc641bb3ffde446e7722ef1a16d0c2cb982b86a84d3a0
SHA1 hash: 355e0beae53e23770abdd14e6005f7fed2a08856
MD5 hash: b4ffa437550300083face95e8a38b5b8
humanhash: salami-quiet-earth-zulu
File name:b4ffa437550300083face95e8a38b5b8.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:508'416 bytes
First seen:2022-08-11 10:48:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash adffb89e68195f8e01044600df994188 (4 x RecordBreaker)
ssdeep 12288:Y5qJGqHJN6O9s4wev4f7OzRMCCoLyMtnqYnoo53Sc:YIASN6O9sTH7OSAlnqYn
Threatray 168 similar samples on MalwareBazaar
TLSH T104B48E27F2E0C837D2636B389D5B5264A839BE503E39584A3FE41D4C4F3D7813A652A7
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
b4ffa437550300083face95e8a38b5b8.exe
Verdict:
Malicious activity
Analysis date:
2022-08-11 10:49:28 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/5ac880fb-f418-400a-a12b-087e78c4215b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/297959/
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28663/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger
Link:
https://www.filescan.io/uploads/62f4deab7a5eee504807cfbd/reports/e812a908-8034-4b7d-a264-54ab4211d683/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2eae290e-d575-411b-9792-fa78ec457d40
Result
Threat name:
CryptOne, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1049880
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 10:53:41 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g3ygmxedwlalffugktlptawyqziavp77wrymolsegmpk3y3i4zla._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
15021b22e43f3522e7da1ba69256c9d9cda849794d44aa1e58cabc3282818362
RecordBreaker
3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc
RecordBreaker
3e75d91d07dce3cbf0f867ea91d5ac804eb371afa2b327b862f3c5324b694e46
RecordBreaker
45aebea9d7e8dfe9d950cc6cf90b5c6e023bd90ef810d8dfde5c9462c642617a
RecordBreaker
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
RecordBreaker
9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
RecordBreaker
a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
RecordBreaker
aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
RecordBreaker
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
RecordBreaker
ceff984891362aced0814217cae0a2d70980172e0f7a54adcb3c66cd3cd82704
RecordBreaker
+ 158 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer
Link:
https://tria.ge/reports/220811-mwn2sagef8/
Behaviour
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://77.73.132.74
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/48f25e12-6ad0-401c-b0f8-6d0f89421d05/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
MD5 hash:
b4ffa437550300083face95e8a38b5b8
SHA1 hash:
355e0beae53e23770abdd14e6005f7fed2a08856
Link:
https://www.unpac.me/results/48f25e12-6ad0-401c-b0f8-6d0f89421d05/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36f0665c83b2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.78
Link:
https://yomi.yoroi.company/submissions/36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2263228/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297959/

Comments