MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
SHA3-384 hash: 20dd2791269ddfb035984866cc86db3c5cb520b39ee6aba203f7231e57ae07fdc3871ce79c705dfaf5e7cae0540200e0
SHA1 hash: ccca241fb8fcf7f56e5ed118cb0db87373681024
MD5 hash: 5f91d60e117449a2059bcbaa577a8ce4
humanhash: may-minnesota-golf-ack
File name:5f91d60e117449a2059bcbaa577a8ce4.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:622'592 bytes
First seen:2022-08-09 16:29:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 222c367e9ac4d337d94bcf41d218e853 (4 x RecordBreaker)
ssdeep 12288:U7hEmjpxH7rbl+6ji1aFDfPY9O2KCJcxeoo53Sc:IpTnJ+6cWDuqst
Threatray 145 similar samples on MalwareBazaar
TLSH T180D47D37B1E08433D2762B7C9E1B53A89C2A7E106D78B84A2FE41D8C5F3D6913939197
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
5f91d60e117449a2059bcbaa577a8ce4.exe
Verdict:
Malicious activity
Analysis date:
2022-08-09 16:35:05 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/1a64f7c8-b69f-42b4-96ee-7ae919be511e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/297393/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.24366.13777.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28442/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/62f28ba0f6ec33747d8d6d4d/reports/28f84069-8087-499f-b75b-38209723149a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1935ad0e-693a-49ca-8698-a4bfb0808635
Result
Threat name:
CryptOne, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1048644
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 14:50:29 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hx4i6ibjumpxrxjhjimzyn5affno5vrorw7dwei6lydyawhjpyea._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
01e1bbb9bb2c3e5ed68df65a2846faa611ec9bfcbf664e0abd5b72005502cac4
RecordBreaker
1ee4cefacf38cfc2928f412ee4d23e2254c8265754d8eb4b86e331f2ca8616e5
RecordBreaker
22539844faca3d0029a5421ecc146979eb16ac4257fe8011a84f0686052f5b19
RecordBreaker
5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b
RecordBreaker
74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393
RecordBreaker
85599a173b0e02feec2e6a0260166da49b870cb8d87c2b0beb1e79473e921d83
RecordBreaker
a880ebe9be4e9888ac2faa331c390b5d477fc828bf2e677e003d3adf74f4e9ec
RecordBreaker
b91e7fd40c84298ad53bae03f61d45d9e8ea323c6fecded7a4b98f53ebf36110
RecordBreaker
e733cbcaee33c4e99d99f2a3b82e2530e10dac7106edfaea681a98abb04f92b6
RecordBreaker
e7924441cf355557372d5d058eeb30341f9bb4be80f54449ea66b288d183b928
RecordBreaker
+ 135 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer
Link:
https://tria.ge/reports/220809-tzsygaeec9/
Behaviour
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://77.73.132.74
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/13940f05-7306-4c8b-bb22-1e96184881cf/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
MD5 hash:
5f91d60e117449a2059bcbaa577a8ce4
SHA1 hash:
ccca241fb8fcf7f56e5ed118cb0db87373681024
Link:
https://www.unpac.me/results/13940f05-7306-4c8b-bb22-1e96184881cf/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3df88f2029a3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/297393/

Comments