MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e
SHA3-384 hash: 33dbfae9b5c28a0413f74b895ac8d1b373799363bc1dc86a2be412220f3232b0d3089c297cd901209e894111cc3f7460
SHA1 hash: e7ddb9ca41bbb89b8bca6f295d03db56d23b3bb1
MD5 hash: 48a0e3e9e1307c788dfe9c1ab6939621
humanhash: johnny-yankee-dakota-utah
File name:48a0e3e9e1307c788dfe9c1ab6939621.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:554'912 bytes
First seen:2022-08-28 06:22:54 UTC
Last seen:2022-08-28 06:49:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b82b0468d2de138092bb342ea80f445 (14 x RecordBreaker, 12 x ArkeiStealer, 11 x RedLineStealer)
ssdeep 12288:qCeyDS0NtesQEDag1OEEpsL5T8euvyy7vvLrOQqr:c9g1OEEm5T8zvvPur
Threatray 395 similar samples on MalwareBazaar
TLSH T1DDC46C2078E08672DDF324BE06ECB531056DB8F047365AC757C81BFAEA242D1AF3655A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
48a0e3e9e1307c788dfe9c1ab6939621.exe
Verdict:
Malicious activity
Analysis date:
2022-08-28 06:25:11 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/db197f23-2355-42b6-82cd-2724d970023c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301783/
Detection(s):
SecuriteInfo.com.Variant.Lazy.238211.31414.23218.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30466/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630b09d988961a865265107e/reports/91cd8d1b-1cf7-4ee0-9d63-df24aa4dfcef/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e9400ad9-0a45-4acf-bc0b-6e7b5c58058c
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1059189
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e/
Threat name:
Win32.Infostealer.Bandra
Create hunting rule
Status:
Malicious
First seen:
2022-08-28 06:23:11 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6vliw6ctwv62n4gsouphxltfmzaqpoiqiyj7tp2toz4a3ujgixa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
RecordBreaker
502e941d65f743b781b0214c9c37b8d4cca4b27fa7d62be943a63a9de93812d3
RecordBreaker
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
RecordBreaker
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
RecordBreaker
7c08ff1bd686c7c8913115c92319b59badc4dbc116a6630419440828141203fe
RecordBreaker
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
RecordBreaker
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
RecordBreaker
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
RecordBreaker
d7b364b3054f74a5e624e6abf2ca24bf91833a4fb4f437ce5601b12a4a214438
RecordBreaker
f3ad5816ebb2ce9d1d4e6a864b3d0548490392c2387e7b2655d7f2edfed7da69
RecordBreaker
+ 385 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220828-g5f5msefe4/
Unpacked files
SH256 hash:
c3dde04158ea53fd8c3856590f2d94969161d5bf0d149307085906c522158fa8
MD5 hash:
e35df5d7436028a402c1fd2e8e5e86cd
SHA1 hash:
4c54d3dc9dc6002696b18c77902297ccc60a4099
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9bc62c0-d730-4ca0-b0c3-3140c3d6bbc9/
Parent samples :
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e
SH256 hash:
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e
MD5 hash:
48a0e3e9e1307c788dfe9c1ab6939621
SHA1 hash:
e7ddb9ca41bbb89b8bca6f295d03db56d23b3bb1
Link:
https://www.unpac.me/results/e9bc62c0-d730-4ca0-b0c3-3140c3d6bbc9/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/37aab45bc29d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2280742/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/301783/

Comments