MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 75fdaa0818914d1fea617ddcff0d0b1f5f6f9f24a543e8413a769d438a3620f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RecordBreaker
Vendor detections: 15
| SHA256 hash: | 75fdaa0818914d1fea617ddcff0d0b1f5f6f9f24a543e8413a769d438a3620f3 |
|---|---|
| SHA3-384 hash: | 704e41f60ae42ba641b9b29912490ee1474bcaf622df089ced0553763d1aa08e4d8f7055a09fba7199b49333b99435ef |
| SHA1 hash: | eb5e5589e447f340b7f42b586d38d7e3af1a6b5a |
| MD5 hash: | 933e8e76c60369b901a3bd71b1b8f7b4 |
| humanhash: | washington-social-shade-yellow |
| File name: | file |
| Download: | download sample |
| Signature | RecordBreaker |
| File size: | 6'521'856 bytes |
| First seen: | 2022-11-05 15:21:07 UTC |
| Last seen: | 2022-11-05 21:04:05 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2f285ed6f05eae8b1321ad1b364e9c75 (19 x RecordBreaker, 2 x RaccoonStealer) |
| ssdeep | 98304:QRvy1KViN/ea/gcyK6Nv1CfE1w3KaIpdOcLssho2vdEvdN8My8bOxrMS:Ga48xLYNKU9CbT4OaHyLNJDIg |
| Threatray | 929 similar samples on MalwareBazaar |
| TLSH | T1F46623E323140256E9BACC39C9677FD032B78BEDDB0028745BE9F6C11963E95961780B |
| TrID | 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | ec949cc8e8f2a2f2 (1 x RecordBreaker) |
| Reporter |  andretavare5 |
| Tags: | exe recordbreaker |
andretavare5
Sample downloaded from https://vk.com/doc760294778_651780306?hash=dUppYlTyr3MCYb22NpYNKiDoKivImhS27pl1FTIcENL&dl=G43DAMRZGQ3TOOA:1667661265:dmIkpKhFiKcXdBjwyhKezkcvOIocjXUS3TLahO2HQL4&api=1&no_preview=1#setup1Intelligence
File Origin
# of uploads :
137
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-05 15:22:56 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
Raccoon Stealer v2
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Signature
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect virtualization through RDTSC time measurements
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2022-11-05 15:22:18 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
13 of 26 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Label(s):
raccoon
Similar samples:
+ 919 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:24657be197f2ca3b4dc26cf6888a3afe discovery spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Malware Config
C2 Extraction:
http://88.119.171.176/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
729c1d515c347bd54d247edec201d188b8f1c93bb7f999d5d27847d614596eb9
MD5 hash:
7e40c5a26cf7d0e3b33807602c3ebbcb
SHA1 hash:
f691287bf0823142672da002617b006f2156fe22
SH256 hash:
75fdaa0818914d1fea617ddcff0d0b1f5f6f9f24a543e8413a769d438a3620f3
MD5 hash:
933e8e76c60369b901a3bd71b1b8f7b4
SHA1 hash:
eb5e5589e447f340b7f42b586d38d7e3af1a6b5a
Malware family:
RecordBreaker
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.