MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f
SHA3-384 hash: 252cc2ac44f2fcc750e0939d4bdde3b11235239d74a5fc8284c7f5387dc6e95822515a670cd1748a20b35a09e11b2e26
SHA1 hash: ace665685db22580ed543c07c9eefb78d1ae81cb
MD5 hash: 9ca905ac5edf0518acbc45cd7fc8feb4
humanhash: pizza-mango-eighteen-connecticut
File name:fd2b5d87e8e073c701253840c2f3997669c760a68b01c.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:3'042'943 bytes
First seen:2022-08-27 16:35:44 UTC
Last seen:2022-08-27 17:39:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f8b3c8d3b81ee0a1bcb782d69039ec2 (2 x RedLineStealer, 1 x RecordBreaker, 1 x PrivateLoader)
ssdeep 24576:0a7fUBT//pJjGCsf8VJPbSN8S1ZQLrGCBk+jyDqbcvVWOjwKQli+TUsLXcC:03qeRbK8S1ZgI+uubcJQlZ9Xh
Threatray 245 similar samples on MalwareBazaar
TLSH T112E58D29A7F549AFDAA6277784FF233523369E244B2BC7EE8448C739DE431919C16301
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://inexu.top/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://inexu.top/ https://threatfox.abuse.ch/ioc/845736/

Intelligence

File Origin
# of uploads :
2
# of downloads :
359
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
fd2b5d87e8e073c701253840c2f3997669c760a68b01c.exe
Verdict:
Malicious activity
Analysis date:
2022-08-27 16:37:58 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Link:
https://app.any.run/tasks/0df5a419-0f5c-42ec-8354-5e8554c36740

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301657/
Detection(s):
SecuriteInfo.com.Malware.AI.4236044792.17638.25835.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30356/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug overlay packed spyeye
Link:
https://www.filescan.io/uploads/630a4835393b1c8c471afe50/reports/91060f04-ee53-44bd-bdcc-fb24637099c8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c3981fe-6c5c-41ae-a00c-40224debe4b1
Result
Threat name:
PrivateLoader, Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1058980
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected PrivateLoader
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f/
Threat name:
Win32.Trojan.RaccoonSteal
Create hunting rule
Status:
Malicious
First seen:
2022-08-27 16:36:11 UTC
File Type:
PE (Exe)
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uvv3b7i4bz4oajfhbamf44zozu4oyfgrma42eyh62iefw2iqmpq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
2b363cc63cf28746e0365b3d25d22e890eec1414ffc4e16e6f078065ab1eb1a2
RecordBreaker
3bf0e1d823e337ba4372bd55bb57d93789bda09c5bf3d8b82a308781c8f9a09f
RecordBreaker
6da056b3e14e136e17890c04f270ed1decbca6d67eb0f0fed914569e4fba8a92
RecordBreaker
76b0ba4ab1eecf85812948358e917f8d255f073c401ff504516128065c8ce805
RecordBreaker
7fa1b425c7bc7f04e84aae8b76cd1e6d1db56dab966ff273b5101816525f61c4
RecordBreaker
8129a8a2a4c77198a9a65c393cfc37f8f6ab83842a9c9f430ab1186db9cd0771
RecordBreaker
adef4ddb07e0ed81129a662c8c1d2d9083bafd0f112e55ca46586381edd70cb9
RecordBreaker
b22de3458444455c80b7d79c6d4e2b5925867930ce51ed641cc909b45297c8bb
RecordBreaker
eb6b1b9f09b85071216997ab608a8fa3fe45e7f8840dec8417a17133140a9ac5
RecordBreaker
f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c
RecordBreaker
+ 235 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220827-t38s4adcek/
Unpacked files
SH256 hash:
cea4429bca2322bf1514792763e818259fe1ff05f0343f2c05ae406aed34a776
MD5 hash:
dafdddadf170f82f70bb3b30e135e9e4
SHA1 hash:
c96269d7f66ac9daf538bcb3a2d91edaf4b337e7
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/ba2b73e5-663c-4c4d-b484-409c0740a284/
SH256 hash:
fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f
MD5 hash:
9ca905ac5edf0518acbc45cd7fc8feb4
SHA1 hash:
ace665685db22580ed543c07c9eefb78d1ae81cb
Link:
https://www.unpac.me/results/ba2b73e5-663c-4c4d-b484-409c0740a284/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fd2b5d87e8e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe fd2b5d87e8e073c701253840c2f3997669c760a68b01cd1307f69042db48831f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2280742/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/301657/
  
URLhaus
https://urlhaus.abuse.ch/url/2281645/

Comments