MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SHA3-384 hash: abde3d5baa31dab942e6080ea22d160e7923d99737122fb5f63f6552b83c18f82909d982a9b9dde3f811c5370b8ad2d3
SHA1 hash: dda8b56068d0455f88a6ef67ff399fce572da4a4
MD5 hash: 5ed829269f2a5486bcb5f702722c5a74
humanhash: twenty-hotel-social-hot
File name:5ed829269f2a5486bcb5f702722c5a74.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:508'416 bytes
First seen:2022-08-11 10:48:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash adffb89e68195f8e01044600df994188 (4 x RecordBreaker)
ssdeep 12288:Y5qJGqHJN6O9s4wev4f7OzRMCCoLyMtnqYOoo53Sc:YIASN6O9sTH7OSAlnqYO
Threatray 168 similar samples on MalwareBazaar
TLSH T1C9B48E27F2E0C837D2636B389D5B5264A839BE503E39584A3FE41D4C4F3D7813A652A7
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
322
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
5ed829269f2a5486bcb5f702722c5a74.exe
Verdict:
Malicious activity
Analysis date:
2022-08-11 10:49:29 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/f82368c5-3819-49cc-94f0-ebf39c55e754

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/297960/
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28664/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger
Link:
https://www.filescan.io/uploads/62f4deac7a5eee504807cfbf/reports/caa28eaa-a98f-4031-bde8-8af03aac8f40/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/532f8001-32fc-4cc4-adbf-68b365a341f1
Result
Threat name:
CryptOne, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1049886
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 09:46:13 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylw3izl7gaffrwud7gtiorlv53b6crrcv3or7zxs4uguvbcpj2fq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
15021b22e43f3522e7da1ba69256c9d9cda849794d44aa1e58cabc3282818362
RecordBreaker
3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc
RecordBreaker
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
RecordBreaker
3e75d91d07dce3cbf0f867ea91d5ac804eb371afa2b327b862f3c5324b694e46
RecordBreaker
45aebea9d7e8dfe9d950cc6cf90b5c6e023bd90ef810d8dfde5c9462c642617a
RecordBreaker
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
RecordBreaker
9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
RecordBreaker
a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
RecordBreaker
aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
RecordBreaker
ceff984891362aced0814217cae0a2d70980172e0f7a54adcb3c66cd3cd82704
RecordBreaker
+ 158 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer
Link:
https://tria.ge/reports/220811-mwn2sagef9/
Behaviour
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://77.73.132.74
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/780630ea-03f5-4342-92f9-2eb33f66fa1d/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
MD5 hash:
5ed829269f2a5486bcb5f702722c5a74
SHA1 hash:
dda8b56068d0455f88a6ef67ff399fce572da4a4
Link:
https://www.unpac.me/results/780630ea-03f5-4342-92f9-2eb33f66fa1d/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c2edb4657f30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2263228/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297960/

Comments