MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RecordBreaker

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
SHA3-384 hash:	84acf4f30c9923b7837c14317e5b6592da74ef31d16f20a9c4683c655dc7e2f6291fbcb2d9b6b7a6848c51e775e54959
SHA1 hash:	1b5a0a7e01bbcc534f78ac7f00c6f55df630327d
MD5 hash:	12d32b643bad12d41543ad9c98f4962a
humanhash:	double-sad-beryllium-stream
File name:	SecuriteInfo.com.W32.AIDetect.malware2.31289.20754
Download:	download sample
Signature	RecordBreaker Create hunting rule
File size:	554'912 bytes
First seen:	2022-08-27 17:39:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5b82b0468d2de138092bb342ea80f445 (14 x RecordBreaker, 12 x ArkeiStealer, 11 x RedLineStealer)
ssdeep	12288:wCF+z0NtesQEDag1+ETDcXBtJguufyxjoG1xIjQqF:Qg1+ETYBngvG1xIzF
TLSH	T16AC47D5039E08172DCF260BA06ECB531156DB5F007295AD79BCE0BFED7246E07B3668A
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	SecuriteInfoCom
Tags:	exe recordbreaker

Intelligence

File Origin

# of uploads :

# of downloads :

450

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

raccoon

ID:

File name:

SecuriteInfo.com.W32.AIDetect.malware2.31289.20754

Verdict:

Malicious activity

Analysis date:

2022-08-27 17:41:28 UTC

Tags:

trojan raccoon recordbreaker

Link:

https://app.any.run/tasks/e40ac7c0-5be7-45ba-9d95-2f7eb56a98aa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/301670/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.31289.20754.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/30365/overview

Behaviour

MalwareBazaar

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/630a56f8393b1c8c471b3164/reports/14a416de-18b5-427b-97c1-43c2e3a03478/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/cb72d360-069f-40d9-8c0c-56b8aa29f3df

Result

Threat name:

Raccoon Stealer v2

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1058994

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Writes to foreign memory regions

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2/

Threat name:

Win32.Trojan.RaccoonSteal

Status:

Malicious

First seen:

2022-08-27 17:39:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 26 (57.69%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5icihjksgtbvq26kg2rjfqtqvporewl33en5vyehggt375suhpra._file

Verdict:

malicious

Label(s):

raccoon

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220827-v8ac6aehe8/

Unpacked files

SH256 hash:

c3dde04158ea53fd8c3856590f2d94969161d5bf0d149307085906c522158fa8

MD5 hash:

e35df5d7436028a402c1fd2e8e5e86cd

SHA1 hash:

4c54d3dc9dc6002696b18c77902297ccc60a4099

Detections:

win_recordbreaker_auto

Link:

https://www.unpac.me/results/81ea9195-5a6e-4207-931c-2425ebc9c15f/

Parent samples :

8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
79f36c4c4acf56e6f58cea8407320741350770132bf852e66a7b1bb9dbaed3e0
0a1d548fb9debe4346fc13c05be5ace9b7429318fe2228c217dd20ca4542e32b
ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2
37aab45bc29dabed378693a8f3dd732b32083dc882309fcdfa9bb3c06e89322e

SH256 hash:

ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2

MD5 hash:

12d32b643bad12d41543ad9c98f4962a

SHA1 hash:

1b5a0a7e01bbcc534f78ac7f00c6f55df630327d

Link:

https://www.unpac.me/results/81ea9195-5a6e-4207-931c-2425ebc9c15f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ea0483a55234c3586bca36a292c270abdd12597bd91bdae08731a7bff6543be2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:	https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/