MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 4 File information Comments 1

SHA256 hash:	79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
SHA3-384 hash:	7fa094ffaa6c94b61a33cd29aade81ee1ccb4d47c62bd437ac7f24a60ae0621246f48e4966f705e72c8d37c33d28a824
SHA1 hash:	bfa2053c28d1a7eda9ca5648b2d35a9ccb9af0c6
MD5 hash:	30827580125d2932a9b616bc4fdafb4e
humanhash:	november-indigo-early-william
File name:	30827580125d2932a9b616bc4fdafb4e
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	554'912 bytes
First seen:	2022-08-27 14:57:45 UTC
Last seen:	2022-08-27 15:51:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5b82b0468d2de138092bb342ea80f445 (14 x RecordBreaker, 12 x ArkeiStealer, 11 x RedLineStealer)
ssdeep	12288:PCeaDqENtesQEDag1OEkhMzhr0euvy5fpdDQqQ:jtg1OEkmhr0QZQ
TLSH	T152C46C2078E1C662DDF220FE4AFCB531156DB8F017256AC753C80BFAD6602D26F3659A
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe recordbreaker

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://filetick.pro/	https://threatfox.abuse.ch/ioc/845696/

Intelligence

File Origin

# of uploads :

# of downloads :

289

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

raccoon

ID:

File name:

30827580125d2932a9b616bc4fdafb4e

Verdict:

Malicious activity

Analysis date:

2022-08-27 15:00:23 UTC

Tags:

trojan raccoon recordbreaker loader stealer

Link:

https://app.any.run/tasks/d790a6ba-2027-49db-a0e4-3f39f35b8a3e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/301624/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.25521.10127.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/30331/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/630a30fffba5fadd5382bca5/reports/217037e9-5c32-4be7-a133-39e1239e3086/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bb4fd733-7a71-4aee-ae8f-bb67a2e385bf

Result

Threat name:

PrivateLoader, Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1058928

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

DLL side loading technique detected

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected PrivateLoader

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0/

Threat name:

Win32.Trojan.SpyEye

Status:

Malicious

First seen:

2022-08-27 14:58:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 26 (57.69%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=phzwytckz5lon5mm5kcaomqhie2qo4atfp4ffztkpmn3tw5o2pqa._file

Verdict:

malicious

Label(s):

raccoon

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220827-sb53fsccel/

Unpacked files

SH256 hash:

c3dde04158ea53fd8c3856590f2d94969161d5bf0d149307085906c522158fa8

MD5 hash:

e35df5d7436028a402c1fd2e8e5e86cd

SHA1 hash:

4c54d3dc9dc6002696b18c77902297ccc60a4099

Detections:

win_recordbreaker_auto

Link:

https://www.unpac.me/results/2f4e31dc-2b3e-428c-a53e-bebcc3f33d02/

Parent samples :

8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e

SH256 hash:

79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0

MD5 hash:

30827580125d2932a9b616bc4fdafb4e

SHA1 hash:

bfa2053c28d1a7eda9ca5648b2d35a9ccb9af0c6

Link:

https://www.unpac.me/results/2f4e31dc-2b3e-428c-a53e-bebcc3f33d02/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:	https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/