MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6cde7214122a3c08f0a0c66673ae8c70188740d780cde1b5eb1f839d412a17f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6cde7214122a3c08f0a0c66673ae8c70188740d780cde1b5eb1f839d412a17f
SHA3-384 hash: d889834f5e55a24dd3e25833197b2ee3811d344e1be4aafc132f3425394465bece0c8eda8c74695db29455fda33f798a
SHA1 hash: e05ae5d5d88f9e21050f3aa6f9fdd68f42f8ab0a
MD5 hash: 26a4ce0cf0f487120666b3b0754ee3bf
humanhash: texas-nitrogen-failed-early
File name:26a4ce0cf0f487120666b3b0754ee3bf.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:27'957'985 bytes
First seen:2022-12-02 16:05:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2f285ed6f05eae8b1321ad1b364e9c75 (19 x RecordBreaker, 2 x RaccoonStealer)
ssdeep 196608:gOYhB8N7l9Xd+yEWSnaI89WPC56q8jZdrxys:g7CLzWPXtZdxys
TLSH T126572373625511C0F5A98D3090377FA133F23E2EDAC2687C67E9B9D104325D2A627E9B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c8e3eae4b696c6ec (1 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://92.204.160.116/

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
26a4ce0cf0f487120666b3b0754ee3bf.exe
Verdict:
Malicious activity
Analysis date:
2022-12-02 16:08:39 UTC
Tags:
trojan raccoon recordbreaker loader
Link:
https://app.any.run/tasks/37cd316c-20ec-494a-be81-5c7ea7f737b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive greyware overlay packed raccoon raccoonstealer racealer
Link:
https://www.filescan.io/uploads/638a22879a505ad9423c9745/reports/e422300a-ec85-4386-861d-7146ba402c44/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1126629
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect virtualization through RDTSC time measurements
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Suspicious
First seen:
2022-11-28 17:56:42 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
24 of 40 (60.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23g6oikbekr4bdykbrtgooxiy4ayq5anpagn4g26wh4dtvasuf7q._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:d1c2e66ed4b4bf32894219072544b5b9 stealer
Link:
https://tria.ge/reports/221202-tj5bkacf95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Raccoon
Malware Config
C2 Extraction:
http://92.204.160.116/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cc134237-711d-4f19-9858-554a21b1f062
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d6cde7214122/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6cde7214122a3c08f0a0c66673ae8c70188740d780cde1b5eb1f839d412a17f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments