MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881
SHA3-384 hash: 5f02477beb176050415a157e13626ccff68dc13dcffd02569ed6cb61b5d883de3fc06f2f8128e95b03786a69e6aa969f
SHA1 hash: 63cc90533182d6695ff42349450d8c3e405633c4
MD5 hash: 0207371cfb73753b781d00fb2556cf8d
humanhash: wyoming-yellow-robin-september
File name:0207371cfb73753b781d00fb2556cf8d.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:1'005'984 bytes
First seen:2022-08-28 11:02:12 UTC
Last seen:2022-08-28 12:03:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 48c28d9f3783f0e32815b0b4c57a60a9 (73 x RecordBreaker, 23 x RedLineStealer, 21 x ArkeiStealer)
ssdeep 24576:kL4/jsrG9GLIydM+sbtV9I7T3RL7scUzB:kSpGLIydMlaHd7sfzB
Threatray 429 similar samples on MalwareBazaar
TLSH T14425AE6079C18172EDF260BA42ECF963567EFCB007314ACB568983EEC6286D16F32557
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://167.235.234.131/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://167.235.234.131/ https://threatfox.abuse.ch/ioc/845906/

Intelligence

File Origin
# of uploads :
2
# of downloads :
484
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
http://cusara.xyz/f/3.exe
Verdict:
Malicious activity
Analysis date:
2022-08-28 10:59:00 UTC
Tags:
trojan loader rat redline
Link:
https://app.any.run/tasks/c7b3635f-237a-4c0d-9855-d5daa31fcc61

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301843/
Detection(s):
SecuriteInfo.com.Variant.Lazy.238286.259.6342.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30513/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630b4bed70b1f4ccb9150843/reports/69a00353-20a3-4cb8-9fef-f7efffef8074/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a882f64-cdde-4612-a734-33ddeb39db5a
Result
Threat name:
PrivateLoader, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1059249
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
DLL side loading technique detected
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected PrivateLoader
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-28 11:03:08 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wy3hitktblhnip3mbo7owiveoy6jscrnkivhypihbvj2rhuhvcaq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
RecordBreaker
384cbb2efa2eff91b9057d4194a877c786b267a97f04bea420f7985ede7fe409
RecordBreaker
502e941d65f743b781b0214c9c37b8d4cca4b27fa7d62be943a63a9de93812d3
RecordBreaker
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
RecordBreaker
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
RecordBreaker
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
RecordBreaker
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
RecordBreaker
81e05eb633640a98c742391a80612538789f366cda17324eef17cdb66d87cb66
RecordBreaker
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
RecordBreaker
d184612e2f0b0b065986b94869296330d56e356e2d1ef077461e064bdcb4d3a2
RecordBreaker
+ 419 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220828-m5n35sgdgl/
Unpacked files
SH256 hash:
513e8ddb97aeaefa0ec333048b007c676acd7fd63040e45384acf90b6ba78f62
MD5 hash:
69420a89d9b97b40d96897825d9bbaaf
SHA1 hash:
b13841eeed003647ec41b5c2ef8148317bd524e3
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/d7937df8-aad7-4d34-8b84-8a1e5e9d801b/
Parent samples :
b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881
24c46b67b1095dab537bf18f64be46668ab3901abc5a8874269fdbc4f7e52a9d
SH256 hash:
b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881
MD5 hash:
0207371cfb73753b781d00fb2556cf8d
SHA1 hash:
63cc90533182d6695ff42349450d8c3e405633c4
Link:
https://www.unpac.me/results/d7937df8-aad7-4d34-8b84-8a1e5e9d801b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b636744d530a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe b636744d530aced43f6c0bbeeb22a4763c990a2d522a7c3d070d53a89e87a881

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2281645/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/301843/

Comments