MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 4 File information Comments

SHA256 hash:	74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393
SHA3-384 hash:	9f830bf80fc367b76a646ef7de942be519019de5f3c8faf1684d55879f32ef7fdd1d24fa66f9a9a1cb200e08c279b19f
SHA1 hash:	9852a0393d214dc9ac638c41ca75f31517e06bdf
MD5 hash:	638b05de457bd94078b45e51a2a62868
humanhash:	tango-comet-four-echo
File name:	638b05de457bd94078b45e51a2a62868.exe
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	622'592 bytes
First seen:	2022-08-07 20:00:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	222c367e9ac4d337d94bcf41d218e853 (4 x RecordBreaker)
ssdeep	12288:U7hEmjpxH7rbl+6ji1aFDfPY9O2KCJcxOoo53Sc:IpTnJ+6cWDuqsd
Threatray	140 similar samples on MalwareBazaar
TLSH	T167D47D33B1E08437D2762B7C9E5B53989C2A7E106D38B84A2FE41D8C5F3D6913939297
TrID	68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58) 27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61) 1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4) 1.3% (.SCR) Windows screen saver (13101/52/3) 0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter	abuse_ch
Tags:	exe recordbreaker

abuse_ch

RecordBreaker C2:
http://77.73.132.74/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://77.73.132.74/	https://threatfox.abuse.ch/ioc/841804/

Intelligence

File Origin

# of uploads :

# of downloads :

356

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

638b05de457bd94078b45e51a2a62868.exe

Verdict:

No threats detected

Analysis date:

2022-08-07 20:00:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c40e109c-1fa7-44eb-b4f3-d1deab6ecf1c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/297009/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.24366.13777.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/28313/overview

Behaviour

MalwareBazaar

CheckCmdLine

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

keylogger

Link:

https://www.filescan.io/uploads/62f01a77b7eec65627963190/reports/5357c5f8-d896-443e-91f4-a990fbe9695d/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e972cb9a-84fe-4fb7-9042-b2397c0cc721

Result

Threat name:

CryptOne, Raccoon Stealer v2

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1047570

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Yara detected CryptOne packer

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393/

Threat name:

Win32.Trojan.RaccoonSteal

Status:

Malicious

First seen:

2022-08-07 20:01:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oqyb7mrt3hcb4shtrziveukbbvak2zd3wwyluamwptpjw4qeoojq._file

Verdict:

malicious

RecordBreaker

1ee4cefacf38cfc2928f412ee4d23e2254c8265754d8eb4b86e331f2ca8616e5

RecordBreaker

22539844faca3d0029a5421ecc146979eb16ac4257fe8011a84f0686052f5b19

RecordBreaker

3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc

RecordBreaker

5e440e04f382464db10245c9f730d64d839368ef763bb564deadcacafb24e32b

RecordBreaker

85599a173b0e02feec2e6a0260166da49b870cb8d87c2b0beb1e79473e921d83

RecordBreaker

a880ebe9be4e9888ac2faa331c390b5d477fc828bf2e677e003d3adf74f4e9ec

RecordBreaker

b91e7fd40c84298ad53bae03f61d45d9e8ea323c6fecded7a4b98f53ebf36110

RecordBreaker

e733cbcaee33c4e99d99f2a3b82e2530e10dac7106edfaea681a98abb04f92b6

RecordBreaker

e7924441cf355557372d5d058eeb30341f9bb4be80f54449ea66b288d183b928

RecordBreaker

+ 130 additional samples on MalwareBazaar

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer

Link:

https://tria.ge/reports/220807-yrh6hshgf7/

Behaviour

Raccoon

Raccoon Stealer payload

Malware Config

C2 Extraction:

http://77.73.132.74

Unpacked files

SH256 hash:

ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e

MD5 hash:

d28fd6744208e7fb03ae3ab8663961ae

SHA1 hash:

ddc4d920c5ddab6d8521aa1abbbea11e7f09e421

Link:

https://www.unpac.me/results/95fa6e3a-9487-4c7b-b367-3c57d51adec1/

Parent samples :

8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b

SH256 hash:

74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393

MD5 hash:

638b05de457bd94078b45e51a2a62868

SHA1 hash:

9852a0393d214dc9ac638c41ca75f31517e06bdf

Link:

https://www.unpac.me/results/95fa6e3a-9487-4c7b-b367-3c57d51adec1/

Malware family:

CryptOne

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/74301fb233d9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.