MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
SHA3-384 hash: 7160ed5679f817f517c107d7d8baf3a8a9c2d4fe5f144798e06417a9c2f3eb6545b77c9e5edcb3ffbecaeda3162b5d64
SHA1 hash: c4720d8198817281c9adf90cbb3625085555c08b
MD5 hash: d298d343ec8646477f5d7f6e4c8353f6
humanhash: juliet-kansas-friend-snake
File name:d298d343ec8646477f5d7f6e4c8353f6.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:508'416 bytes
First seen:2022-08-11 10:47:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash adffb89e68195f8e01044600df994188 (4 x RecordBreaker)
ssdeep 12288:Y5qJGqHJN6O9s4wev4f7OzRMCCoLyMtnqYfoo53Sc:YIASN6O9sTH7OSAlnqYf
Threatray 169 similar samples on MalwareBazaar
TLSH T1B3B48D27F2E0C837D2636B389D5B5264A839BE503E39584A3FE41D4C4F3D7813A652A7
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
1
# of downloads :
313
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
d298d343ec8646477f5d7f6e4c8353f6.exe
Verdict:
Malicious activity
Analysis date:
2022-08-11 10:52:02 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/2bde1256-53be-41d8-8af4-50266ea4ead6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/297957/
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28661/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger
Link:
https://www.filescan.io/uploads/62f4dea8c8022caa1ab9bb76/reports/6ef44590-6238-4aa4-945a-f19abba52043/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6d2168ac-3401-4678-93f0-a1e2f603177b
Result
Threat name:
CryptOne, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1049882
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 11:47:56 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
17 of 40 (42.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wdh5l4lfl5l33sewov6brao64t6tvoxyuesu6rl4omoa56bzybq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
15021b22e43f3522e7da1ba69256c9d9cda849794d44aa1e58cabc3282818362
RecordBreaker
3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc
RecordBreaker
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
RecordBreaker
3e75d91d07dce3cbf0f867ea91d5ac804eb371afa2b327b862f3c5324b694e46
RecordBreaker
45aebea9d7e8dfe9d950cc6cf90b5c6e023bd90ef810d8dfde5c9462c642617a
RecordBreaker
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
RecordBreaker
9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
RecordBreaker
a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
RecordBreaker
aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
RecordBreaker
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
RecordBreaker
+ 159 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:afb5c633c4650f69312baef49db9dfa4 stealer
Link:
https://tria.ge/reports/220811-mv42lsecak/
Behaviour
Raccoon
Raccoon Stealer payload
Malware Config
C2 Extraction:
http://77.73.132.74
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/d84ae522-5e9c-4b05-883f-617bb5201b8e/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
MD5 hash:
d298d343ec8646477f5d7f6e4c8353f6
SHA1 hash:
c4720d8198817281c9adf90cbb3625085555c08b
Link:
https://www.unpac.me/results/d84ae522-5e9c-4b05-883f-617bb5201b8e/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dd867eaf8b2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.78
Link:
https://yomi.yoroi.company/submissions/dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2263228/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297957/

Comments