MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0
SHA3-384 hash: 6b96ae87a7e19fb8a1dca9a076a6a7b9d06b6dd1a419d77b9343c9879367ab75680a7fcfb33795e8e548c1d19df44a76
SHA1 hash: f7086d16cfb9d4958706615e18b3ff3be3c3d68e
MD5 hash: c83a27859a197277ecff8561db6d4831
humanhash: ceiling-fish-red-spaghetti
File name:samplebin.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:12'156'928 bytes
First seen:2022-11-12 03:04:52 UTC
Last seen:2022-11-12 04:41:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 55b10b9a68cf4c9445f709a0442d415e (6 x RecordBreaker)
ssdeep 196608:WRm3Rd2sXdQKH9Gf/uPhTG5fek6W1f6G0BdyqJ7ON9xdtYHgLkbL+PbjiXPr0:WcRb9GfghTG5fAkiDdxixdUHufi/I
Threatray 122 similar samples on MalwareBazaar
TLSH T180C6115E62D08064DC9DCC346126E9F8727D5E1E4E80987A6FBB3DAD39133A3931A533
TrID 53.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.8% (.EXE) Win64 Executable (generic) (10523/12/4)
11.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win32 Executable (generic) (4505/5/1)
3.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 00c09eeef47979b2 (2 x RecordBreaker)
Reporter AndreGironda
Tags:exe RaccoonV2 RaccoonV2Stealer recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
samplebin.exe
Verdict:
No threats detected
Analysis date:
2022-11-12 03:38:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e1f7c558-1133-4b1b-8482-35aee0fa205d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/332744/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.34590.32508.7693.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed shell32.dll
Link:
https://www.filescan.io/uploads/636f0d5f37a53af3a7f57075/reports/e14a0618-cb2c-405b-8bad-61ab183dcc59/overview
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b04f0b88-8402-49bd-accb-b5fc61e9acec
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1111665
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-12 03:05:29 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvlp56bqhty6iwu4vnmwjkbmsjsnsawfxj6ijadbh4rvpw3b6cya._file
Verdict:
unknown
Similar samples:
3534fd0b617be19bf24f9b7ff1e98ab23b98aef40bbc2413554a4ec5e016997e
RecordBreaker
37923fb04b4ee3103e82cb67c78febda94b8ce7c93ef35d90bb8ff371600342b
RecordBreaker
ba9b4ed1a5f1e4f658430f393969f1b6a602c5534d745ad3f12fae35cf2a64d1
RecordBreaker
d67b76360660ba2c0fab5788a64023ca219c027d2c66f3d22418ccffcae78776
RecordBreaker
e92b4f323c469808f029e3d970b30684c4a23d652fa1c7da324e14cbd6d04709
RecordBreaker
fd3f9ee2a7b4e35be97140818562dc4470f90705cbd959e87c07ed983692e33d
RecordBreaker
+ 112 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:7c8382f6564c7ad3408fc5d9a1df98c2
Link:
https://tria.ge/reports/221112-dk6ysadd45/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Malware Config
C2 Extraction:
http://45.153.242.180/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bc0eaba0-6fea-4b86-ba18-625d9c360816
Unpacked files
SH256 hash:
6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0
MD5 hash:
c83a27859a197277ecff8561db6d4831
SHA1 hash:
f7086d16cfb9d4958706615e18b3ff3be3c3d68e
Detections:
raccoonstealer
Create hunting rule
Link:
https://www.unpac.me/results/66ee7abe-c47e-4c5b-b7fb-0b885774c1fb/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6d56fef8303c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:Detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution).
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:recordbreaker_win_generic
Create hunting rule
Author:_kphi

File information

The table below shows additional information about this malware sample such as delivery method and external references.

RecordBreaker

Executable exe e92b4f323c469808f029e3d970b30684c4a23d652fa1c7da324e14cbd6d04709

RecordBreaker

Executable exe 6d56fef8303cf1e45a9cab5964a82c9264d902c5ba7c8480613f2357db61f0b0

(this sample)

  
Link
https://blog.cyble.com/2022/11/02/new-laplas-clipper-distributed-by-smokeloader/
  
Dropped by
SHA256 e92b4f323c469808f029e3d970b30684c4a23d652fa1c7da324e14cbd6d04709
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/332744/
  
Dropped by
MD5 4e4bd491a86e7c94714b3fa69d774e9f

Comments