MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c9716a41f6865025271a42553f3240810b678f89bffaa2a5c69a0576757947ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RecordBreaker
Vendor detections: 11
| SHA256 hash: | c9716a41f6865025271a42553f3240810b678f89bffaa2a5c69a0576757947ab |
|---|---|
| SHA3-384 hash: | c4166047fede778e78f6740b32927a9de20e014fd6e6a725f09339ebe6e7c4508e823da90137b00be2f078a7b72844b9 |
| SHA1 hash: | cca2a8c695e4328b09689666de42d13386b0ce13 |
| MD5 hash: | 3a049aee3f55f0baca2e2a34592928c7 |
| humanhash: | music-undress-cola-south |
| File name: | SеТuр_patched.exe |
| Download: | download sample |
| Signature | RecordBreaker |
| File size: | 11'539'968 bytes |
| First seen: | 2023-02-27 23:46:37 UTC |
| Last seen: | 2023-02-28 01:29:00 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | cdf44720c7910f1a70d7d2a345132c9f (1 x RecordBreaker) |
| ssdeep | 196608:PrQt9IzyHyvJ1fJ1JtJxb0ORJmBHnI6JzxrkxzUBKdgrvW:Ef2yANJ/tJxJJmZnIszxrkxzKrvW |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | T170C6331758CFE5CAEBE128344F17D3EA33FB42A54D808C3DBCC69DC566A5BA4600E562 |
| TrID | 30.2% (.EXE) Win64 Executable (generic) (10523/12/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4505/5/1) 5.9% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  atomiczsec |
| Tags: | exe recordbreaker |
Intelligence
File Origin
# of uploads :
2
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SеТuр_patched.exe
Verdict:
No threats detected
Analysis date:
2023-02-27 23:48:19 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
75%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Result
Verdict:
MALICIOUS
Verdict:
Suspicious
Result
Threat name:
Raccoon Stealer v2
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
DLL side loading technique detected
Found potential ransomware demand text
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2023-02-27 23:47:13 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
15 of 25 (60.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
raccoon
Score:
10/10
Tags:
family:raccoon botnet:f26f614d4c0bc2bcd6601785661fb5cf stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Raccoon
Malware Config
C2 Extraction:
http://83.217.11.34
http://83.217.11.35
http://83.217.11.35
Unpacked files
SH256 hash:
f828a72a4151595a8380108f94ecd9a0d954a40506ff7acca7f50c1cedd6b5d3
MD5 hash:
ebcd30a8135327c06fe8fcbe6fe3d801
SHA1 hash:
ca129e9702dac690b755f505b944fd8ad36b3e08
SH256 hash:
bad9459d155d080543c51c0f01713372c797858933a3a82d0efe1dd5b06933b9
MD5 hash:
c8a2bef3293119df68971574b7441628
SHA1 hash:
81f0e0a2ecf830d1a4a3daac63123a707ef1db83
SH256 hash:
c9716a41f6865025271a42553f3240810b678f89bffaa2a5c69a0576757947ab
MD5 hash:
3a049aee3f55f0baca2e2a34592928c7
SHA1 hash:
cca2a8c695e4328b09689666de42d13386b0ce13
Malware family:
RecordBreaker
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.Part of #OperationPhotoshop - https://twitter.com/atomiczsec