MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
SHA3-384 hash: 6a1832064b94f2e7592dd0c4714ea0f3d4efa394b22c7cc88ce245a441876905349e03b27b2e399620cf9854a5c496d7
SHA1 hash: c67ee1d7e81f46a5c08b45dca6eb354af1ee7b8c
MD5 hash: 8f5056a3da7c93b60a5c0a9a9c26242c
humanhash: burger-yellow-tennis-may
File name:8f5056a3da7c93b60a5c0a9a9c26242c.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:508'416 bytes
First seen:2022-08-09 16:29:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash adffb89e68195f8e01044600df994188 (4 x RecordBreaker)
ssdeep 12288:Y5qJGqHJN6O9s4wev4f7OzRMCCoLyMtnqY2oo53Sc:YIASN6O9sTH7OSAlnqY2
Threatray 146 similar samples on MalwareBazaar
TLSH T13AB48E27F2E0C437D2636B389D5B9264A839BE503E39584A3FE41D4C4F3D7813A652A7
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
8f5056a3da7c93b60a5c0a9a9c26242c.exe
Verdict:
Malicious activity
Analysis date:
2022-08-09 16:35:06 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/71e49c2f-9255-44b1-ab4c-fc4baeb13607

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/297390/
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28440/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger
Link:
https://www.filescan.io/uploads/62f28b9b810e2831b7302999/reports/1cb347bb-14e6-44c3-acca-271f3b615c63/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4ef1363-cf24-4c00-b4a5-ce286174c5a3
Result
Threat name:
CryptOne, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1048756
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 10:53:40 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjrrjao6yxcl7xq3sdubfbukl3oqsp2e5o5qmjpzdzsurria55tq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
15021b22e43f3522e7da1ba69256c9d9cda849794d44aa1e58cabc3282818362
RecordBreaker
3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc
RecordBreaker
3e75d91d07dce3cbf0f867ea91d5ac804eb371afa2b327b862f3c5324b694e46
RecordBreaker
45aebea9d7e8dfe9d950cc6cf90b5c6e023bd90ef810d8dfde5c9462c642617a
RecordBreaker
9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
RecordBreaker
a880ebe9be4e9888ac2faa331c390b5d477fc828bf2e677e003d3adf74f4e9ec
RecordBreaker
a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
RecordBreaker
aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
RecordBreaker
ceff984891362aced0814217cae0a2d70980172e0f7a54adcb3c66cd3cd82704
RecordBreaker
e733cbcaee33c4e99d99f2a3b82e2530e10dac7106edfaea681a98abb04f92b6
RecordBreaker
+ 136 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer
Link:
https://tria.ge/reports/220809-ty8mjachdj/
Behaviour
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://77.73.132.74
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/38ebadcc-1320-4f33-9106-c60ab1e366e9/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
MD5 hash:
8f5056a3da7c93b60a5c0a9a9c26242c
SHA1 hash:
c67ee1d7e81f46a5c08b45dca6eb354af1ee7b8c
Link:
https://www.unpac.me/results/38ebadcc-1320-4f33-9106-c60ab1e366e9/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8a631481dec5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2263228/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297390/

Comments