MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
SHA3-384 hash: d44996ebb6b8b0a5a74ec25bca09aac3b8388224de52947839817cb5057f0bb4a0eb9eb3183628a4fb21f47315562ff1
SHA1 hash: dc466700f1db5c6dfe3495261ab3893a37c73d01
MD5 hash: da4d2022554efd18282bb3dd9d7bbff2
humanhash: wyoming-two-timing-uranus
File name:da4d2022554efd18282bb3dd9d7bbff2
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:554'912 bytes
First seen:2022-08-27 14:08:50 UTC
Last seen:2022-08-27 16:47:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b82b0468d2de138092bb342ea80f445 (14 x RecordBreaker, 12 x ArkeiStealer, 11 x RedLineStealer)
ssdeep 12288:qCVmzRNtesQEDag1+EzucfptRouufyJ69XvTzeRQqt:Xg1+EzHpPo5fvIt
Threatray 242 similar samples on MalwareBazaar
TLSH T1A5C47C6178E48173DDF221BA4BECF535047DA4F04725A6C756C80BFEC6206E0AF365AA
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter zbetcheckin
Tags:32 exe recordbreaker

Intelligence

File Origin
# of uploads :
3
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
da4d2022554efd18282bb3dd9d7bbff2
Verdict:
Malicious activity
Analysis date:
2022-08-27 14:11:53 UTC
Tags:
trojan raccoon recordbreaker loader
Link:
https://app.any.run/tasks/4f9efb46-60d9-4188-81a5-7d22b95dc529

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301617/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.7582.30820.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30326/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630a25c4f205e2ee767dd0fe/reports/33f25a30-9bfd-4f71-96ea-6b1e7f479886/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/02443ed7-e8c3-4cef-a7eb-ef7efd79eb59
Result
Threat name:
PrivateLoader, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1058916
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
DLL side loading technique detected
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected PrivateLoader
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92/
Threat name:
Win32.Infostealer.Bandra
Create hunting rule
Status:
Malicious
First seen:
2022-08-27 13:56:50 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwqfnm7bjyjw4f4jbqcpe4hndxwlzjwwp2ypb7wzcrlj4t52rkja._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
142bd5cafadc7dbdeb4c50c917a4956c8122761ee92272efeea11bcb0cb449a8
RecordBreaker
2b363cc63cf28746e0365b3d25d22e890eec1414ffc4e16e6f078065ab1eb1a2
RecordBreaker
3bf0e1d823e337ba4372bd55bb57d93789bda09c5bf3d8b82a308781c8f9a09f
RecordBreaker
7c08ff1bd686c7c8913115c92319b59badc4dbc116a6630419440828141203fe
RecordBreaker
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
RecordBreaker
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
RecordBreaker
c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4
RecordBreaker
d7b364b3054f74a5e624e6abf2ca24bf91833a4fb4f437ce5601b12a4a214438
RecordBreaker
eb6b1b9f09b85071216997ab608a8fa3fe45e7f8840dec8417a17133140a9ac5
RecordBreaker
f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c
RecordBreaker
+ 232 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220827-rf46aacgd9/
Unpacked files
SH256 hash:
c3dde04158ea53fd8c3856590f2d94969161d5bf0d149307085906c522158fa8
MD5 hash:
e35df5d7436028a402c1fd2e8e5e86cd
SHA1 hash:
4c54d3dc9dc6002696b18c77902297ccc60a4099
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/6048be8f-daf9-4ccf-b3ba-454446caa4af/
Parent samples :
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e
SH256 hash:
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
MD5 hash:
da4d2022554efd18282bb3dd9d7bbff2
SHA1 hash:
dc466700f1db5c6dfe3495261ab3893a37c73d01
Link:
https://www.unpac.me/results/6048be8f-daf9-4ccf-b3ba-454446caa4af/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2280742/
Cape
Cape
https://www.capesandbox.com/analysis/301617/

Comments


Avatar
zbet commented on 2022-08-27 14:08:52 UTC

url : hxxp://fujhi.com/f/bin.exe