MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc
SHA3-384 hash: 314d84a8ce296dae8f558b43d2493d1b000df2543ce8ba9ff0fd0a2142a05275365b65251bd0a2df4918ceb40650035f
SHA1 hash: 6ef12272209426b46d8cacc57b2f06f7066f8de8
MD5 hash: e7ca0eebc8e2075a87e023aaff15b2cd
humanhash: leopard-grey-sixteen-december
File name:SecuriteInfo.com.Variant.Zusy.435740.24183.26008
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:235'520 bytes
First seen:2022-08-17 12:33:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 14ce7ca1f5460d1e391272f9c37619af (12 x RecordBreaker, 8 x RedLineStealer, 2 x Smoke Loader)
ssdeep 6144:XeCTOInsYYM0KWEzYAOpE7+k+GZVD8ignQ:XeuOIsNZk+GZVDEQ
Threatray 223 similar samples on MalwareBazaar
TLSH T101349EA070D28872D472913149E0DB7D4D3DF93D8BE259EF37940F7E4F2B6819522A26
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Variant.Zusy.435740.24183.26008
Verdict:
Malicious activity
Analysis date:
2022-08-17 12:35:35 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/480e0d94-4e10-427d-a953-56868da680a9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/299276/
Detection(s):
SecuriteInfo.com.Variant.Zusy.435740.24183.26008.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/29236/overview
Behaviour
MalwareBazaar
MeasuringTime
CallSleep
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62fce0b93cbb9456913cad99/reports/5c01ac6a-e4c2-419a-8177-fd53b7ea2376/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/28212de7-26c6-42fd-ab6c-a51b0ffe6faf
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1053003
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc/
Threat name:
Win32.Backdoor.DCRat
Create hunting rule
Status:
Malicious
First seen:
2022-08-17 12:34:08 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2b3spps4fdgp4pi26nmc2krj6wyewotnaipmjpjy5vv37i7lwxga._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
142bd5cafadc7dbdeb4c50c917a4956c8122761ee92272efeea11bcb0cb449a8
RecordBreaker
2b363cc63cf28746e0365b3d25d22e890eec1414ffc4e16e6f078065ab1eb1a2
RecordBreaker
384cbb2efa2eff91b9057d4194a877c786b267a97f04bea420f7985ede7fe409
RecordBreaker
3bf0e1d823e337ba4372bd55bb57d93789bda09c5bf3d8b82a308781c8f9a09f
RecordBreaker
6acb4a99183888374a991d9e5e79a20cc9899b4bed11e3e22437ea6f4a16091f
RecordBreaker
a97181ba55b9ba36d21729b745c50836f1fe58007a4508511b1161a6d796b754
RecordBreaker
b76370c6ab76406b5a29a2bd245968bb29b72d320572c35f9d679022719cb92f
RecordBreaker
c35d4e641adf21bead54611499c416c8e2de75ac9609832d1f32c476140c38d4
RecordBreaker
d184612e2f0b0b065986b94869296330d56e356e2d1ef077461e064bdcb4d3a2
RecordBreaker
fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74
RecordBreaker
+ 213 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/220817-prrm8afeel/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
a07626d7d7aa9b994dbbd013c14199556278fc630cc2254614a89d6ab06af78f
MD5 hash:
b380ef1ef112a12663e4cbcd1ee4fd0c
SHA1 hash:
5bc7b032dcfdd223fac9d0421f658ef2192441e8
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/aa20912a-b6c7-4a1c-b1e0-07cff392355f/
SH256 hash:
d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc
MD5 hash:
e7ca0eebc8e2075a87e023aaff15b2cd
SHA1 hash:
6ef12272209426b46d8cacc57b2f06f7066f8de8
Link:
https://www.unpac.me/results/aa20912a-b6c7-4a1c-b1e0-07cff392355f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d07727be5c28/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2273842/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/299276/

Comments