MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5
SHA3-384 hash:	3129804f49877cd247fcee022438a3bf8f987e616d80cbecab6dc952033c05560388778f68df4b22d762e7f5b9c6edc7
SHA1 hash:	93103b00195d411c9b4b926c68945b0b665b27b5
MD5 hash:	e216ba0c1e89509112ed4a68272a0340
humanhash:	missouri-violet-bacon-friend
File name:	e216ba0c1e89509112ed4a68272a0340
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	285'184 bytes
First seen:	2022-09-01 01:23:45 UTC
Last seen:	2022-09-01 01:31:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	62e5e433525a836ab07f79f0ab9b6078 (2 x RecordBreaker, 2 x RedLineStealer, 1 x Smoke Loader)
ssdeep	3072:3jX5+PCPW8UmkjHeZQSjLeRn77sA+9RHoY4w0:LaCPomypKi1U9RHoYx0
TLSH	T15254E01576C3C8B1D0A311705835C7A19ABFE8311B78119F37A82B2D1FB1EE09EB6796
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	480c1c4c4f590b14 (113 x Smoke Loader, 92 x RedLineStealer, 83 x Amadey)
Reporter	zbetcheckin
Tags:	32 exe recordbreaker

Intelligence

File Origin

# of uploads :

# of downloads :

276

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RaccoonV2

Link:

https://www.capesandbox.com/analysis/307037/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.61588233.9873.10447.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/36241/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware smoke

Link:

https://www.filescan.io/uploads/63100a2aa7450371f69424d8/reports/f3dc1620-4905-44ae-8aa2-f3110f54cf5c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/faf5c37e-39f6-45ab-b72e-07dc0f81e297

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1062223

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-09-01 01:24:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sgsmn6pt2grajk34p54q4hn3s3atll7vfrxhncwcyefcj2bjdgsq._file

Result

Malware family:

raccoon

Score:

10/10

Tags:

family:raccoon botnet:845e611fd4976be9d7cdeeaeddc44199 discovery spyware stealer

Link:

https://tria.ge/reports/220901-bsczkagbd8/

Behaviour

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Raccoon

Malware Config

C2 Extraction:

http://193.106.191.199/

Unpacked files

SH256 hash:

669ab7600d395c35cec418447b2a730d36cbe8006769e35b82b0c8324331eb2d

MD5 hash:

55bdc93e49f6634fd5e174a29b76d0d6

SHA1 hash:

80d06bb1a57e18514c2bc6a1168e189f38de8dc7

Detections:

win_recordbreaker_auto

raccoonstealer

Link:

https://www.unpac.me/results/3ca12d23-3741-45cb-9a08-8e5f92ff04a6/

SH256 hash:

91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5

MD5 hash:

e216ba0c1e89509112ed4a68272a0340

SHA1 hash:

93103b00195d411c9b4b926c68945b0b665b27b5

Link:

https://www.unpac.me/results/3ca12d23-3741-45cb-9a08-8e5f92ff04a6/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/91a4c6f9f3d1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.