MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0
SHA3-384 hash: 3b937acfcb6246ded3a27365e5d3c7ab1eb614a4ef70dc4fa03b16821f693ea19bbc841e8abbea340a2cef6e0a65d889
SHA1 hash: 7e5d373c72c8ef3069aab13cf042a88dcf83c473
MD5 hash: ac2905ab89ac3a775a7b3b729f8f25a4
humanhash: golf-iowa-lactose-venus
File name:ac2905ab89ac3a775a7b3b729f8f25a4.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:248'832 bytes
First seen:2023-06-12 20:20:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f87b3efdf116f7ab8f1afe2047eb9b9 (1 x RecordBreaker)
ssdeep 3072:gKoOPj4nC0Yi4hIshjXCtKdHinMlCuEIvGSQk5xZC1rlorkswu:QOPsC0Y8sCwHiWC7ISor
Threatray 10 similar samples on MalwareBazaar
TLSH T1D834F813DEE17F64E6358B32AE2EC6E837CEB5118F19776652289A1F05B01B1C963370
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0142646066626600 (1 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://65.108.80.36:8089/

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
ac2905ab89ac3a775a7b3b729f8f25a4.exe
Verdict:
Malicious activity
Analysis date:
2023-06-12 20:22:38 UTC
Tags:
raccoon recordbreaker trojan loader stealer
Link:
https://app.any.run/tasks/90152381-d207-43ad-8ba2-bb3e7f3ec7ea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/398103/
Detection(s):
Win.Packed.Zusy-10003906-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/90391/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64877e3008b287b7595b4ff1/reports/22a112c0-cb1d-44b9-943f-819f28d978b2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40d787a9-dc59-4f5c-8615-9178acd007fe
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1253228
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2023-06-12 20:21:06 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
22 of 24 (91.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ysq34phjcngoh4butbonwgypd6i4crr37rww2trn7njbvnrnoya._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
1d2b30b68962af3d19af75515aae44eeb39031432655824b18d1121a8a582aab
RecordBreaker
1efe7e276b7b35248dc5ff09a38e1f85b7c425367385fa51adaeebcca4e54e4c
RecordBreaker
2379723159ed6b1301813d5e06ae76370cb218b7f3b50c4bd4306db1682f2ccc
RecordBreaker
43630c9fda7054562a21db7a11df3b35e73001b9d81eb1591ab785bdb2e5cd2a
RecordBreaker
53e00a4184accd0427b110d614ca18eeb37de902a4c6d2782cfb1f2302f78ada
RecordBreaker
53ea06f8e6db1b09239111275f338bd703fd15bd38a3b8956f1df19c1f5b9f9f
RecordBreaker
68393678ccf5bdc8d7075290a5ee4da24c878a6b11f45cf2342c442ca9aa09ca
RecordBreaker
79564fca4784cf3f6056a6909a630f14c8b7836174fa2032ff60009761f36aee
RecordBreaker
c01bcd2fee216131267cbaf603d48dfaf7647bba122674042739a10676a8e44c
RecordBreaker
e10f1e70fa84b2d135123e72e4c46770d9f663f0c2036e3e7a4e7a3bf8cd5f96
RecordBreaker
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230612-y4zzssdf83/
Unpacked files
SH256 hash:
b69b8bd3e6d8d6d2549a069cafb89a4b21b322eb9979b6b5766da209cb2622a2
MD5 hash:
b98ab1178ac1866956f6f4da1f7d578d
SHA1 hash:
98b727ba925846115372732025583df9147a2b24
Detections:
raccoonstealer
Create hunting rule
Link:
https://www.unpac.me/results/fffa0b41-9729-4b96-8d40-602590f197af/
Parent samples :
de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0
b185566c7a557c05928d4342fbe95c63ea5eb10822818aab33826db3dda56f11
bd8164f6460bc87be9354020ef41e523243c6f7fce9be655413ee9c891d62c0c
SH256 hash:
de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0
MD5 hash:
ac2905ab89ac3a775a7b3b729f8f25a4
SHA1 hash:
7e5d373c72c8ef3069aab13cf042a88dcf83c473
Link:
https://www.unpac.me/results/fffa0b41-9729-4b96-8d40-602590f197af/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de250df1e748/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/398103/

Comments