MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c
SHA3-384 hash: 05612ebbfdc94915f7ccc1a0195dbf4661c7f24a3c16775a5782be8c43b0b7e2eea443218ae35993a22318efc842ea40
SHA1 hash: 99f6cdc41e98d6c518ac8bc87f69246c81bef5aa
MD5 hash: fff36f059af564c0b55f6f9f3e285f52
humanhash: six-october-queen-maryland
File name:file.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:7'873'024 bytes
First seen:2023-03-14 18:01:50 UTC
Last seen:2023-03-14 19:37:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 98304:eQ6OEG+X1GElfvAe7nGjs8w/l5nxfIkdBW+Fe8dR:eQ6O+FGElfIkGo8wrx3BneK
Threatray 547 similar samples on MalwareBazaar
TLSH T12F8684C9729076CEC827E4329A645D64F6E06776531BC613C16B13EB9E0EB6BEF040E1
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
file.exe
Verdict:
Malicious activity
Analysis date:
2023-03-14 18:05:05 UTC
Tags:
raccoon recordbreaker trojan loader stealer
Link:
https://app.any.run/tasks/a07a4e91-099c-452b-b64b-62a1872eb817

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/374310/
Detection(s):
SecuriteInfo.com.Variant.Tedy.313360.22621.4705.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed raccoon
Link:
https://www.filescan.io/uploads/6410b69c4be1693e4f5dd344/reports/b09095f5-ba97-4114-b0c3-685592e87d28/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c94dec88-1cf9-482d-b74a-818e5fd39f4b
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1193556
Signature
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Found potential ransomware demand text
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c/
Threat name:
ByteCode-MSIL.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2023-03-14 18:02:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pahwsiclcpaw6bsskpfqoye4szyxcgu2c2k76sx54hdmejqbqy6a._file
Verdict:
malicious
Similar samples:
0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee
RecordBreaker
14c0bffd95c773ce08eba775cae7fe5b0fe0e5ea82fef286ffe7bd985936e5d2
RecordBreaker
419202387b82935462c14db4e32c3b0cad38c7787098cc956cbd470be8eae0ea
RecordBreaker
7910bae57ea65b0389078fce2009e479c73546df088973cbfbd55a8b783f27e1
RecordBreaker
801cf2afff165a6f3b89e62afad21778e4ea38d60571bebb80416891e64be998
RecordBreaker
8143ce518658a354d495b5c6c694f6c40299a67e3c356c613f9414afbf0bf14e
RecordBreaker
a3ee259c5f89d0bfaddb0b80d082fcf2dfe5c92b4ff20a956c5ffb3873a51611
RecordBreaker
c2c7aa9c4e43f92f909b60f5bf65a26c91a91f023ae2e1de5ef74565f31bc34b
RecordBreaker
e1fd2d534eed837ebb0fb3b0f25732dadaf4bfd95de92b6c44935d624d991dab
RecordBreaker
+ 537 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230314-wmfhqaah3w/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
885d8219c4187d5afc537826f5ccec52fa65a4a33cb12fd8cd990c75abf35726
MD5 hash:
d1e1930966633e785df2abb437d24e93
SHA1 hash:
ad37315aa1aed7b43033991c8caa7f3608b562bb
Link:
https://www.unpac.me/results/52112288-191d-41fc-b5fb-1283947afb78/
SH256 hash:
73be8794b078958c8aa7361e63caeaa3e7e4099521a29967c9f2baff2b741468
MD5 hash:
ca3a4bf22400c9faa2245be128c74686
SHA1 hash:
583fa56bd31c0744c31dcb378401c92605462dae
Link:
https://www.unpac.me/results/52112288-191d-41fc-b5fb-1283947afb78/
SH256 hash:
780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c
MD5 hash:
fff36f059af564c0b55f6f9f3e285f52
SHA1 hash:
99f6cdc41e98d6c518ac8bc87f69246c81bef5aa
Link:
https://www.unpac.me/results/52112288-191d-41fc-b5fb-1283947afb78/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/780f69204b13/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.69
Link:
https://yomi.yoroi.company/submissions/780f69204b13c16f065253cb07609c9671711a9a1695ff4afde1c6c22601863c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/374310/

Comments