MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370
SHA3-384 hash: ec57a51f6c8dddbc4877374430b12f4f6cf67b769077a40456bc6a7480367a490ab203c41a6116057dcf4e3bd130c0c2
SHA1 hash: b3134b44f44a0a8468e8c5ca4980624be9c0bddb
MD5 hash: 443aa22be2bfdc5aeb9bbbcf0c8e9d12
humanhash: mango-sad-papa-twenty
File name:443aa22be2bfdc5aeb9bbbcf0c8e9d12.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:14'202'384 bytes
First seen:2023-02-25 20:15:13 UTC
Last seen:2023-02-25 21:27:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 16cf5db3878b2dcf0f97ac9d337625cb (9 x RecordBreaker)
ssdeep 393216:5S7i/zA/MUI28wtqSWcOYU/v3B6M71AGpgwdonLzBf+fxss9t:5UDUUftqrcNU/vRV71AGqIkzBGt
Threatray 17 similar samples on MalwareBazaar
TLSH T177E63363265596C0F1888C39E833FCE1B0F44B5B4A82DC7475EE7BD8593A6F1A506B0B
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9696cce4a4c0624d (2 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://83.217.11.6/

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
443aa22be2bfdc5aeb9bbbcf0c8e9d12.exe
Verdict:
Malicious activity
Analysis date:
2023-02-25 20:19:07 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/c51bbb07-e28b-426a-b18f-745e27732675

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65610190.17211.29175.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
Connecting to a non-recommended domain
Sending an HTTP POST request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63fa6c86663463c1cb678bcf/reports/d9716875-1cd3-461d-9257-fcdc953daa8b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3d40c1cf-bf56-4fa3-b86d-33aaae0b9348
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1182405
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 815236 Sample: V6S8Y6qXr5.exe Startdate: 25/02/2023 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Antivirus detection for URL or domain 2->46 48 8 other signatures 2->48 8 V6S8Y6qXr5.exe 32 2->8         started        process3 dnsIp4 36 83.217.11.6, 49700, 80 ATLEX-ASRU Russian Federation 8->36 38 77.73.134.24, 49702, 80 FIBEROPTIXDE Kazakhstan 8->38 40 77.73.134.35, 49703, 80 FIBEROPTIXDE Kazakhstan 8->40 28 C:\Users\user\AppData\Roaming\h96v587r.exe, PE32+ 8->28 dropped 30 C:\Users\user\AppData\Roaming\H4R91mq4.exe, PE32 8->30 dropped 32 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 8->32 dropped 34 6 other files (4 malicious) 8->34 dropped 52 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->52 54 Tries to harvest and steal browser information (history, passwords, etc) 8->54 56 Tries to evade analysis by execution special instruction (VM detection) 8->56 58 3 other signatures 8->58 13 H4R91mq4.exe 1 8->13         started        16 h96v587r.exe 8->16         started        file5 signatures6 process7 signatures8 60 Machine Learning detection for dropped file 13->60 62 Writes to foreign memory regions 13->62 64 Allocates memory in foreign processes 13->64 66 Injects a PE file into a foreign processes 13->66 18 AppLaunch.exe 1 5 13->18         started        22 conhost.exe 13->22         started        68 Antivirus detection for dropped file 16->68 70 Multi AV Scanner detection for dropped file 16->70 72 Tries to harvest and steal browser information (history, passwords, etc) 16->72 process9 file10 26 C:\ProgramData\...\AdobeAdobe-tupe0.0.6.4.exe, PE32+ 18->26 dropped 50 Creates autostart registry keys with suspicious names 18->50 24 AdobeAdobe-tupe0.0.6.4.exe 18->24         started        signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Suspicious
First seen:
2023-02-20 19:25:15 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
20 of 39 (51.28%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qu4p5lvuzn4loyddwktgfjxt6fcwk6nro5zyqfuuhy5abnbanya._file
Verdict:
malicious
Similar samples:
1b8f84f3e94abdd467e3794e336d0beb69bc52c4cef4def0c83a01727936397b
RecordBreaker
2485066b0a47ef5a72bed598787fc60afa1e15727e0fcb987ba47c9e100a01b1
RecordBreaker
3456b3d72716fa65c41d3b6d8ddd5e6c365cfb8c7fd298a57be5f30b6caf28dd
RecordBreaker
37b90013b2b05efd0ff943fb6b3173bc802d5cc7eb0d24801ee5c298f30b5b3d
RecordBreaker
cd7f075fc5ca8ef703f71de1d9f195e01e9a3433668f0a54898b4d88ea85587b
RecordBreaker
d034c82de08e2aabe9f27089610a46d42fa741cfcaedec06a016810c660b402c
RecordBreaker
e487cc9c5d05a910d82c833029b1dc9ac00e5729ad05d1dcfafaa4fc64496b6d
RecordBreaker
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230225-y15e4seb7v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
925ea6897167d8132657542523625ff7d01cdd87f87d3cb4387fa7d5b3ab4f4e
MD5 hash:
497815ff94241e151381234ef5f7fa41
SHA1 hash:
75cc5fd9aa642ed6f13e8fcdc0160bd686935c31
Link:
https://www.unpac.me/results/3410c260-6571-4ec6-8324-a73a9353284d/
SH256 hash:
d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370
MD5 hash:
443aa22be2bfdc5aeb9bbbcf0c8e9d12
SHA1 hash:
b3134b44f44a0a8468e8c5ca4980624be9c0bddb
Link:
https://www.unpac.me/results/3410c260-6571-4ec6-8324-a73a9353284d/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d429c7f575a6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments