🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789
SHA3-384 hash: 2e59343e614f5b6f4365455bb63e93c763904e417c07f9f0a023336897d5740a97b2b6520a3dbc9faed6fce1911baa28
SHA1 hash: 68c63ebdc82055c61e46f931c93831300d2c8705
MD5 hash: a9f4e5d21dbcb6455928db44bdd058b3
humanhash: glucose-magazine-washington-nineteen
File name:Telekom Rechnung FEBRUAR 2023 pdf .exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:10'819'072 bytes
First seen:2023-03-06 15:40:28 UTC
Last seen:2023-03-06 17:32:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c6788ab459e74ff34b16016192dcb11 (3 x RecordBreaker)
ssdeep 196608:B5JC4k5+cMh7fHyzSAIqn/fy7DKrl2hE9InktedJRY3E0gRBaJLMksWyVqz5dTxC:9RVB9rAI4fyC4hE9fedJiE0CgirWOqzx
TLSH T125B6331293E95943C1D88CF6B6327C9173B01E2F57C168BC3891BB872336B97AD06B56
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e4d2d8c488acb4e4 (4 x RecordBreaker)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://51.195.166.206/

Intelligence

File Origin
# of uploads :
2
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Telekom_Rechnung_FEBRUAR_2023_pdf_.exe
Verdict:
No threats detected
Analysis date:
2023-03-06 11:07:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/029c1ec9-259b-463d-bd7c-3372ae658cf2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/372065/
Detection(s):
SecuriteInfo.com.Variant.Lazy.294720.4289.13399.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Sending a custom TCP request
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6406098f37719e06f50de747/reports/62f58811-cf53-4457-b9de-2a3b14fe6fde/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/03c12493-2412-4b51-b979-18fa7f9db63b
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1187939
Signature
C2 URLs / IPs found in malware configuration
Found potential ransomware demand text
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789/
Threat name:
Win32.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2023-03-06 13:33:40 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
21 of 37 (56.76%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qrs34fpzulsxid6w3lkx753fykj4yrb5ov2fwrob4paqrlaa6eq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230306-s4smtsce4z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789
MD5 hash:
a9f4e5d21dbcb6455928db44bdd058b3
SHA1 hash:
68c63ebdc82055c61e46f931c93831300d2c8705
Link:
https://www.unpac.me/results/7cc66826-1729-4cc4-80da-dcda700e8d49/
Malware family:
RecordBreaker
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f4232df0afcd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4232df0afcd172ba07eb6d6abffbb2e149e6221ebaba2da2e0f1e0845600789

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/372065/

Comments