MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7
SHA3-384 hash: e5a250840e476fa4eae876813d81b455f5c64bb60288e08f660213abfe15fded25e57778d68c628ac9d4abeb34a364b6
SHA1 hash: a5a68431516bdae5c7e642c0327568b7adf85578
MD5 hash: ea53d31beb2f939422d1ad3bf69ea934
humanhash: georgia-maryland-fix-mexico
File name:ea53d31beb2f939422d1ad3bf69ea934
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:1'343'488 bytes
First seen:2022-09-17 03:48:50 UTC
Last seen:2022-09-17 05:23:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ab7c4195f25404e114ffed4f1517076 (1 x RecordBreaker)
ssdeep 6144:Y8ze8oG6jIB/CTAIC1g6vQx32fXzjddJYoQkNniY:3zxoNIB/CUgxYfXvDJNniY
Threatray 14'800 similar samples on MalwareBazaar
TLSH T1A3559466C9691300E38C0BF835D3ED4E9774D20E5E9596D378F9217BA6AFE044EC1EA0
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter zbetcheckin
Tags:32 exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
ea53d31beb2f939422d1ad3bf69ea934
Verdict:
Malicious activity
Analysis date:
2022-09-17 03:49:03 UTC
Tags:
trojan raccoon recordbreaker loader stealer
Link:
https://app.any.run/tasks/33d605ec-404d-4eeb-89e8-7234642b7fd2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/310804/
Detection(s):
SecuriteInfo.com.Variant.Barys.319254.24973.31668.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug greyware hacktool obfuscated packed
Link:
https://www.filescan.io/uploads/632543cbba7b8113dd6dd33f/reports/7194739d-3e4d-4a6e-a9a8-c8010daf4584/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a8bd9aa6-b8e8-41f5-9ff7-8a19f12e2fe7
Result
Threat name:
Azorult, Clipboard Hijacker, Raccoon Ste
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1072078
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Clipboard Hijacker
Yara detected Costura Assembly Loader
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 704620 Sample: SLJurZ4M96.exe Startdate: 17/09/2022 Architecture: WINDOWS Score: 100 71 Snort IDS alert for network traffic 2->71 73 Multi AV Scanner detection for domain / URL 2->73 75 Malicious sample detected (through community Yara rule) 2->75 77 13 other signatures 2->77 10 SLJurZ4M96.exe 13 2->10         started        13 oobeldr.exe 2->13         started        process3 signatures4 89 Maps a DLL or memory area into another process 10->89 91 Contains functionality to detect sleep reduction / modifications 10->91 15 SLJurZ4M96.exe 29 10->15         started        93 Multi AV Scanner detection for dropped file 13->93 process5 dnsIp6 63 193.106.191.146, 49712, 80 BOSPOR-ASRU Russian Federation 15->63 65 itomail.ug 193.106.191.169, 49716, 49729, 80 BOSPOR-ASRU Russian Federation 15->65 43 C:\Users\user\AppData\Roaming\xO41Kn1E.exe, PE32 15->43 dropped 45 C:\Users\user\AppData\Roaming\iRdOvZUX.exe, PE32 15->45 dropped 47 C:\Users\user\AppData\Roaming\OUKzS3PV.exe, PE32 15->47 dropped 49 8 other files (none is malicious) 15->49 dropped 67 Tries to harvest and steal browser information (history, passwords, etc) 15->67 69 Tries to steal Crypto Currency Wallets 15->69 20 iRdOvZUX.exe 3 15->20         started        23 xO41Kn1E.exe 4 15->23         started        25 OUKzS3PV.exe 3 15->25         started        27 7d71o72q.exe 2 15->27         started        file7 signatures8 process9 signatures10 79 Multi AV Scanner detection for dropped file 20->79 81 Injects a PE file into a foreign processes 20->81 29 iRdOvZUX.exe 53 20->29         started        83 Uses schtasks.exe or at.exe to add and modify task schedules 23->83 85 Maps a DLL or memory area into another process 23->85 33 xO41Kn1E.exe 1 23->33         started        87 Encrypted powershell cmdline option found 25->87 35 powershell.exe 25->35         started        process11 dnsIp12 61 itomail.ug 29->61 51 C:\...\api-ms-win-crt-utility-l1-1-0.dll, PE32 29->51 dropped 53 C:\Users\...\api-ms-win-crt-time-l1-1-0.dll, PE32 29->53 dropped 55 C:\Users\...\api-ms-win-crt-string-l1-1-0.dll, PE32 29->55 dropped 59 37 other files (none is malicious) 29->59 dropped 57 C:\Users\user\AppData\Roaming\...\oobeldr.exe, PE32 33->57 dropped 37 schtasks.exe 33->37         started        39 conhost.exe 35->39         started        file13 process14 process15 41 conhost.exe 37->41         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-09-16 10:56:34 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdtnuekdzmzkihwmo2ks2o2k5cujcc3zbfzuoptb7qxlcr3qjl3q._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
04e95db9663cac79ec012fe52be0a8c25fad8ba3644acb0c179123da2504621e
RecordBreaker
53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9
RecordBreaker
6f91871f4fb08ca2553a80a053d983d39fabf1efc619b2e4b87972bd0d9c0d80
RecordBreaker
72b24e99cdd46d7cee31af6d8858782b775db1753d4ed954774a2b1306d5dd89
RecordBreaker
8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
RecordBreaker
a769aa375d2ec5578afbde3ae08c42ed86a2b632c275a30e2498fa0947e532aa
RecordBreaker
b0b3cf6d05e09c3e051e0a0b653f194c3cafdde345bfd85e6364b3e26a7b6f00
RecordBreaker
b684c98dabb8b3e8338f906d1832ca09a8d34d7d79bf33262589b05133e550ed
RecordBreaker
+ 14'790 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:raccoon family:remcos botnet:09162022 botnet:1f95cf62df71eb84e6a269f19941ccbc discovery infostealer persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/220917-edca9shah9/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Azorult
Raccoon
Remcos
Malware Config
C2 Extraction:
http://193.106.191.146/
http://185.215.113.89/
http://195.245.112.115/index.php
nikahuve.ac.ug:6969
kalskala.ac.ug:6969
tuekisaa.ac.ug:6969
parthaha.ac.ug:6969
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d0a96759-9db7-41cb-96e1-cb0e2789af11
Unpacked files
SH256 hash:
6211defab172ff59c671b93e0b4bc654729a9f12adc01283734590839808aad9
MD5 hash:
178afc97f32030acd8a4dbac45669501
SHA1 hash:
55198400919457cf47ca0ba80a73f6c8e1dc7c95
Detections:
raccoonstealer
Create hunting rule
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/dcd8f1f9-8ec5-4b13-9641-e593fd74aa5d/
SH256 hash:
60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7
MD5 hash:
ea53d31beb2f939422d1ad3bf69ea934
SHA1 hash:
a5a68431516bdae5c7e642c0327568b7adf85578
Link:
https://www.unpac.me/results/dcd8f1f9-8ec5-4b13-9641-e593fd74aa5d/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60e6da1143cb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:RansomwareTest3
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:recordbreaker_win_generic
Create hunting rule
Author:_kphi
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe 60e6da1143cb32a41ecc76952d3b4ae8a8910b790973473e61fc2eb147704af7

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1514297/
  
URLhaus
https://urlhaus.abuse.ch/url/2254175/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/2264641/
  
URLhaus
https://urlhaus.abuse.ch/url/1746809/
  
URLhaus
https://urlhaus.abuse.ch/url/2271066/
  
URLhaus
https://urlhaus.abuse.ch/url/2202207/
  
URLhaus
https://urlhaus.abuse.ch/url/2257580/
  
URLhaus
https://urlhaus.abuse.ch/url/1514315/
  
URLhaus
https://urlhaus.abuse.ch/url/1539388/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/1746813/
Cape
Cape
https://www.capesandbox.com/analysis/310804/

Comments


Avatar
zbet commented on 2022-09-17 03:48:53 UTC

url : hxxp://safetygear.pk/ghjk.exe