MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2
SHA3-384 hash: 6acfb1b23991944d8ff2f5634c9cd7c49aee7ce6d87e8412677f16884406fa13ad6adaa3da606dd8779b1caeb6047864
SHA1 hash: 9714743e4ab0a42f34ac855f5af135524f22fa6c
MD5 hash: 7366b7d3c56220f80096881075ab1bef
humanhash: nebraska-butter-alaska-august
File name:SecuriteInfo.com.Trojan.PWS.Stealer.34126.2286.6798
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:352'768 bytes
First seen:2022-08-13 02:29:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3f0f2163b5f7881d53e110f9686f4e64 (2 x RecordBreaker)
ssdeep 6144:/YlKLLdJ9lRSQgFJaZ4KjzLLzvAOQN7LqLpchoZnrTz9YZJ:glILdJ9lR4FEvQ6Lah6nnz9Y3
Threatray 120 similar samples on MalwareBazaar
TLSH T19374BF10B4818072D9F3053A1EF9877C9A3DBEA007A19DEB37D55B6E8F702D0EA31659
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 92ba58b4a24b45a2 (1 x RecordBreaker)
Reporter SecuriteInfoCom
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
379
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Trojan.PWS.Stealer.34126.2286.6798
Verdict:
Malicious activity
Analysis date:
2022-08-13 02:32:15 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Link:
https://app.any.run/tasks/ba484bec-c30a-4a62-980d-7cfb18baa62b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/298296/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.34126.2286.6798.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28820/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62f70cb07a5eee504809dcf1/reports/d031263a-a587-43ab-ad34-6304be562b17/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/267441aa-003b-4dc0-a4e0-28e5ba0a7f4e
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1050849
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
DLL side loading technique detected
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2/
Threat name:
Win32.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2022-08-12 17:16:21 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=st74cysjhhc6vjhngliz7awdneztwrnpxpm5au72ql7i6bozdlba._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0aae4f734962cba43eda599dbff153929a18ce45e814176b5e37998858c70515
RecordBreaker
0fa60d79f881f8616d2b92c02874f6f2a5c16b216b1e256fc31c176355b5c076
RecordBreaker
142bd5cafadc7dbdeb4c50c917a4956c8122761ee92272efeea11bcb0cb449a8
RecordBreaker
6acb4a99183888374a991d9e5e79a20cc9899b4bed11e3e22437ea6f4a16091f
RecordBreaker
7ad2ecc56160b66356e7b1c0a237bbea3a687e100b3bd9a14c4b4a23bb095d05
RecordBreaker
9a62e6ee0e71139a8e68a6092c27deb32077a27980c767a44cd5138ffcdca837
RecordBreaker
b503e95080871d70f3a758124d473ed31a4ede3d2e87d252d3bc878868274023
RecordBreaker
ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396
RecordBreaker
c33aec2527c88a003a6073ee31c1fec0cc3fea40b40f5b1170f67ea5c0838568
RecordBreaker
c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4
RecordBreaker
+ 110 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220813-cy53zacedj/
Unpacked files
SH256 hash:
fcdc29b4d9cb808c178954d08c53c0519970fe585b850204655e44c1a901c4de
MD5 hash:
6b76a3cca3bcef8bbe5a6e054f4c9503
SHA1 hash:
2770d1359a71900d07f5f5f2edf4fd14c8e9019e
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/d3209137-1dba-4f73-b739-0d3f6bbb250d/
Parent samples :
94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2
a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8
SH256 hash:
94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2
MD5 hash:
7366b7d3c56220f80096881075ab1bef
SHA1 hash:
9714743e4ab0a42f34ac855f5af135524f22fa6c
Link:
https://www.unpac.me/results/d3209137-1dba-4f73-b739-0d3f6bbb250d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/94ffc1624939/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2271814/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/298296/

Comments