MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41
SHA3-384 hash: 48a0331ec635eac0df6732cc9764e386cee76a0994752f0a61ed0680fbdccc9c8b13cf21e6de519117f7dd6d1bbf36ce
SHA1 hash: 970c6e81697043ac2a28f408bf3aadcd868fd93e
MD5 hash: e5f370f8c44209601142c1cd8e59feeb
humanhash: may-princess-don-monkey
File name:e5f370f8c44209601142c1cd8e59feeb.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:266'752 bytes
First seen:2022-10-27 15:50:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e8e661a38e14e660bf8d40ad7ce84bcd (9 x RedLineStealer, 3 x Smoke Loader, 3 x RecordBreaker)
ssdeep 3072:JXKhvYc10U0hP/6m1h45F8X1H4tYcPN9yX2MjPoQ8Sa7Xob0Ko:tkH/2P/6m1eaJ4d2GCaG0T
TLSH T17B44E039B643C872CC8545318864C7F12A7FBC31667499973BA43B6F7E703E2A632256
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 480c1c4c4f590b14 (113 x Smoke Loader, 92 x RedLineStealer, 83 x Amadey)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://176.124.203.182/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://176.124.203.182/ https://threatfox.abuse.ch/ioc/950930/

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e5f370f8c44209601142c1cd8e59feeb.exe
Verdict:
No threats detected
Analysis date:
2022-10-27 15:55:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fd55e6da-7e99-40da-9ff0-c91b5a147328

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324994/
Detection(s):
Win.Packed.Tofsee-9951336-0
Create hunting rule

Win.Packed.Pwsx-9975723-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9e1f117a-c5df-4945-a856-72662fecbbca
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1099692
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-27 16:19:30 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtsufukcgc4hosxpfn5xgnqhaqcm4hstbmg7arniotindziu7raq._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/221027-tag5nscfc4/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Detects Smokeloader packer
SmokeLoader
Unpacked files
SH256 hash:
7a68135c35a476c25bf3b1a0a8eba83b8d2a1b1cf62fa09ed837cdb1bf570455
MD5 hash:
4a9dc069af235d03ec5aaa2b6293b56a
SHA1 hash:
2d1dcdc8146cf01a56b154a54616c263f0e84bdd
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/72df0876-2ab6-4b37-811e-f8cf4f8b259f/
Parent samples :
3ff3bd0a125b24b53520ec9ccc0e16d9e0950600ba527754fd194fb1d6a8d099
81e077a7be1719d015dac668d244e423639aab2481ab4dc85965ed3e9149e4f9
7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
71cb880a73d0cb7eb933a93be2b6bb9ee394a2cda1f0f5e882d5bfc83f4e0609
1d3f37d2989eed7acee995c28e8cb9010ef54c45a4ccf84be54d036388a24ab5
a2bc5e03ed38aaafe284d8b29d896ae2708ca03fc2c732bb986bf50411b08f0a
5d15f594dee648ecd97cc2fbc66ee349991ec6ebd040f49439be2ac81f792fa8
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
7f18e1325f88bd8421a03d3d88ad25e2c9e6ff80e39e97efaa7f4d372b3be4dd
4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41
SH256 hash:
4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41
MD5 hash:
e5f370f8c44209601142c1cd8e59feeb
SHA1 hash:
970c6e81697043ac2a28f408bf3aadcd868fd93e
Link:
https://www.unpac.me/results/72df0876-2ab6-4b37-811e-f8cf4f8b259f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2365784/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/324994/

Comments