MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce
SHA3-384 hash: eb827b5e7fe4475ac7ac6c100e306ffa84157bb79b7d00fc6575232538859b8c1732c58c467a254fd5e1b1c69a0dd301
SHA1 hash: 90bf8aeb71797d04ed692d930b4f18e0d7f0e304
MD5 hash: 6dd83a203d5096ea3a1e13b81e9e4d64
humanhash: black-twenty-pluto-mountain
File name:file
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:62'464 bytes
First seen:2022-10-27 14:54:25 UTC
Last seen:2022-10-27 16:23:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c5c36a515b13d54501168b24d2b48063 (15 x RecordBreaker)
ssdeep 768:G3hBdh98zo8hUzAMgRt5O9hDtqCD+4yNdQiEw6ZjqZeS6R4UhSC:AdMzAzjavO9uG+NNdQ4MGQRTv
Threatray 815 similar samples on MalwareBazaar
TLSH T14353F885F4A36407F18344742FF42A6AC78EFF327CAC7943674F6791A2604B1475BAA2
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter jstrosch
Tags:exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-10-27 15:03:50 UTC
Tags:
trojan raccoon recordbreaker
Link:
https://app.any.run/tasks/2099c834-73a6-439b-b1d3-3a59e1aaa2e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RaccoonV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324952/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.34590.5212.20374.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP POST request
Creating a file in the system32 subdirectories
Creating a file
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc58fbe8-7f91-4626-9b58-e5a8c0e9501a
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1099769
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 18:03:34 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5kici4dxflripe3bj52zxasopsdobszdoap5fawa576tbur4k3ha._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
15f34133a747b4493e5a5ca3ac04a6bf9823bb5841884f5cab8ccf086c8ba13e
RecordBreaker
67be4b70e80509300c6d739bea9af68b56c17deb32edae8acec3c683171bf103
RecordBreaker
9a555dcd77621c4d971bc0be1d8bad73459446adc46830dab917e83ac92c43f7
RecordBreaker
aa39655b046e5dff029236ee67d80d3106f2e05f11bd3ee1ebeb41d40321c988
RecordBreaker
b664e49176552308f2388898c0652934ad88464edd55063734aca09261694163
RecordBreaker
f93ba32f22e747dec19ebdf57fc8b1f775feca04f70a69d0660b905956b246f4
RecordBreaker
+ 805 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:9b19cf60d9bdf65b8a2495aa965456c3
Link:
https://tria.ge/reports/221027-sagcpscefq/
Malware Config
C2 Extraction:
http://94.131.107.206
Unpacked files
SH256 hash:
ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce
MD5 hash:
6dd83a203d5096ea3a1e13b81e9e4d64
SHA1 hash:
90bf8aeb71797d04ed692d930b4f18e0d7f0e304
Detections:
raccoonstealer
Create hunting rule
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/86e2c4f4-811b-44d3-a802-8816646a3b54/
Parent samples :
82112a8c76d6bab37acadc1e1a113e43b6dc966f48b9f2a0cc8fdbd844ee2f7a
ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce
5a3544515807da069035c75e37e1570b893768eeab16385402b0464fd26272c0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:Detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution).
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:recordbreaker_win_generic
Create hunting rule
Author:_kphi
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe ea902470772ae28793614f759b824e7c86e0cb23701fd282c0effd30d23c56ce

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/324952/

Comments