MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8
SHA3-384 hash: ae4b0c19d182c7836d16c7a69162001419afef6be20911aa55bfb85be964971c32d701c792ff56de2ea0b2013f8de566
SHA1 hash: decbfc928014d0fd0a3acd1948d9ad337bf4e720
MD5 hash: 5893a7578b1617ec7283bdaa7ed93581
humanhash: king-mobile-kansas-table
File name:1.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:715'264 bytes
First seen:2022-08-14 19:53:06 UTC
Last seen:2022-08-14 20:29:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6096dd6ea1e48bdf90acec78e58f9547 (2 x RecordBreaker, 1 x CoinMiner)
ssdeep 12288:HN3MF6gGszJMHBAeeepDvF66MrH31oTqMAuakkLHEaTuqg15ZIERnw0ZH/O4TaE:JMF6NszJMHBqt31oWMAuakDa2hwALa
Threatray 129 similar samples on MalwareBazaar
TLSH T18DE4BF1138C0C03AD673343206AAE27559BFB4315B6257EF53E8263E9F345E16E2663B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 92d154b272a42488 (1 x RecordBreaker)
Reporter r3dbU7z
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
375
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
1.exe
Verdict:
Malicious activity
Analysis date:
2022-08-14 19:53:27 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Link:
https://app.any.run/tasks/fa33500b-424a-4ba6-afe2-6a5b40ec434b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/298515/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.34126.6416.1279.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Creating a file in the system32 subdirectories
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28929/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62f952bae4e65a67c4a90462/reports/4234852b-a099-4633-b00c-6629603ab5ff/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e504c2b9-23a3-4278-881b-c2f6eb42a156
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1051210
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8/
Threat name:
Win32.Trojan.RaccoonSteal
Create hunting rule
Status:
Malicious
First seen:
2022-08-14 05:59:06 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
17 of 40 (42.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uggsbzhahbnrtzarxxxybbvcrrmny4oy2sdlnjr3u65aunmp624a._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0aae4f734962cba43eda599dbff153929a18ce45e814176b5e37998858c70515
RecordBreaker
0fa60d79f881f8616d2b92c02874f6f2a5c16b216b1e256fc31c176355b5c076
RecordBreaker
142bd5cafadc7dbdeb4c50c917a4956c8122761ee92272efeea11bcb0cb449a8
RecordBreaker
463e7bb6693b947b343cd1ba77247bc8e6504a1fe80f36cdf2a3d7d345e15fd3
RecordBreaker
6acb4a99183888374a991d9e5e79a20cc9899b4bed11e3e22437ea6f4a16091f
RecordBreaker
7f9507e2305941a7263daeba121ce8a83c91bdbe5ad7df94a9dfc0ab4158271f
RecordBreaker
ba66c7a46a35c1b38aa76a199ae19a65674786771b153e0fadc62fcd28367396
RecordBreaker
c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4
RecordBreaker
de35d079d23fe6050502c88b2b40633f4518132df910c7100e000c4b7bcee167
RecordBreaker
e450f635c564bda4d1c22e0d9d4763f582c70a3806d54a3733a0bcc12edb3884
RecordBreaker
+ 119 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220814-ymjaqahgbp/
Unpacked files
SH256 hash:
fcdc29b4d9cb808c178954d08c53c0519970fe585b850204655e44c1a901c4de
MD5 hash:
6b76a3cca3bcef8bbe5a6e054f4c9503
SHA1 hash:
2770d1359a71900d07f5f5f2edf4fd14c8e9019e
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/c5a13b42-d015-4a4f-94da-a645dd6f7d4b/
Parent samples :
94ffc1624939c5eaa4ed32d19f82c369333b45afbbd9d053fa82fe8f05d91ac2
a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8
SH256 hash:
a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8
MD5 hash:
5893a7578b1617ec7283bdaa7ed93581
SHA1 hash:
decbfc928014d0fd0a3acd1948d9ad337bf4e720
Link:
https://www.unpac.me/results/c5a13b42-d015-4a4f-94da-a645dd6f7d4b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a18d20e4e038/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe a18d20e4e0385b19e411bdef8086a28c58dc71d8d486b6a63ba7ba0a358ff6b8

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2271814/
Cape
Cape
https://www.capesandbox.com/analysis/298515/

Comments