🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a
SHA3-384 hash: aaa212562a9adbec13bbd07800430ac0fb781f47af068f50675e3b7d0da3417577cd8ddd3208f9a28edebe9e9724dfa9
SHA1 hash: 599bb8cb50b99f01ff0014ed1a30e87172a88bba
MD5 hash: 3f7051e7e2f7bdbe78be54348128c211
humanhash: california-sixteen-pennsylvania-island
File name:ChromeSetup.exe
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:5'483'560 bytes
First seen:2023-09-29 00:35:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6a0328944a60715360ce2ff3ef9a7b1 (1 x RecordBreaker)
ssdeep 98304:FNZB24hAk5/Mct9KtiWx8Tk/FQoFSJTyvq3v8Vz62UcH:FBLMctkEo27JToA460
Threatray 4 similar samples on MalwareBazaar
TLSH T1824623213DE5A53BE26646B08C58FA7462AEBC314F310BDB53D05B5D1A36CC26B7073A
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 696a6ee2b2b2c2cc (23 x ValleyRAT, 18 x RedLineStealer, 17 x LummaStealer)
Reporter abuse_ch
Tags:exe recordbreaker


Avatar
abuse_ch
RecordBreaker C2:
http://128.140.101.125/

Intelligence

File Origin
# of uploads :
1
# of downloads :
354
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451851/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file in the %temp% directory
Creating a file
Сreating synchronization primitives
Creating a window
Launching cmd.exe command interpreter
Creating a file in the Program Files subdirectories
Creating a service
Searching for the window
Searching for synchronization primitives
Enabling autorun for a service
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug control greyware hacktool keylogger lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65161bf32d5fc006cad8f1d8/reports/7948fbe0-8304-4dc0-8c3e-f6fad4525f27/overview
Verdict:
Malicious
Labled as:
BScope.Trojan
Link:
https://www.hybrid-analysis.com/sample/6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/87cfb9ce-7428-4cff-8749-bc0dc397b0e7
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316136
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to modify clipboard data
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain checking for user administrative privileges
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Maps a DLL or memory area into another process
Sample uses process hollowing technique
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1316136 Sample: ChromeSetup.exe Startdate: 29/09/2023 Architecture: WINDOWS Score: 100 80 Found malware configuration 2->80 82 Yara detected Raccoon Stealer v2 2->82 84 C2 URLs / IPs found in malware configuration 2->84 10 ChromeSetup.exe 5 2->10         started        process3 dnsIp4 74 tinkoff.ru 178.248.236.218, 443, 49795, 49796 QRATORRU Russian Federation 10->74 76 www.tinkoff.ru 10->76 66 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32+ 10->66 dropped 68 C:\Users\user\AppData\...\libvlccore.dll, PE32+ 10->68 dropped 70 C:\Users\user\AppData\Roaming\...\libvlc.dll, PE32+ 10->70 dropped 14 vlc.exe 3 10->14         started        file5 process6 file7 72 C:\Users\user\AppData\...\ChromeSetup.exe, PE32 14->72 dropped 104 Maps a DLL or memory area into another process 14->104 18 ChromeSetup.exe 72 14->18         started        22 cmd.exe 3 14->22         started        signatures8 process9 file10 46 C:\Users\user\AppData\...behaviorgraphoogleUpdate.exe, PE32 18->46 dropped 48 C:\Users\user\AppData\Local\...\psuser_64.dll, PE32+ 18->48 dropped 50 C:\Users\user\AppData\Local\...\psuser.dll, PE32 18->50 dropped 56 65 other files (none is malicious) 18->56 dropped 86 Found evasive API chain checking for user administrative privileges 18->86 24 GoogleUpdate.exe 2 18->24         started        52 C:\Users\user\AppData\Local\...\mfh264enc.exe, PE32 22->52 dropped 54 C:\Users\user\AppData\Local\...\fcfagtokquyc, PE32 22->54 dropped 88 Found hidden mapped module (file has been removed from disk) 22->88 90 Maps a DLL or memory area into another process 22->90 92 Sample uses process hollowing technique 22->92 27 mfh264enc.exe 12 22->27         started        30 conhost.exe 22->30         started        signatures11 process12 dnsIp13 94 Contains functionality to modify clipboard data 24->94 96 Found evasive API chain checking for user administrative privileges 24->96 32 GoogleUpdateSetup.exe 73 24->32         started        78 128.140.101.125, 80 HETZNER-ASDE Germany 27->78 98 Detected unpacking (changes PE section rights) 27->98 100 Detected unpacking (overwrites its own PE header) 27->100 102 Tries to delay execution (extensive OutputDebugStringW loop) 27->102 signatures14 process15 file16 38 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 32->38 dropped 40 C:\Program Files (x86)behaviorgraphoogle\...\psuser.dll, PE32 32->40 dropped 42 C:\Program Files (x86)\...\psmachine_64.dll, PE32+ 32->42 dropped 44 65 other files (none is malicious) 32->44 dropped 35 GoogleUpdate.exe 7 72 32->35         started        process17 file18 58 C:\Program Files (x86)\...behaviorgraphoogleUpdate.exe, PE32 35->58 dropped 60 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 35->60 dropped 62 C:\Program Files (x86)behaviorgraphoogle\...\psuser.dll, PE32 35->62 dropped 64 65 other files (none is malicious) 35->64 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkrk7if4uvw22dvkdi7kwi4ukuzcizvhovsao35werc4dv6chzna._file
Verdict:
unknown
Similar samples:
4c09176981ccb4d6f7c48c6c88d4aad6ec13d5ad9b8afe41cdb40c749933f6b0
RecordBreaker
690e898fd01b69ac3eea36ac0bde48295eeb37b85a76ab96368b02dd7ee51615
RecordBreaker
6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c
RecordBreaker
87f7857a29b50650d3c4bb123409855ed72b3f528a268c3f9d2cd3b12dc1f501
RecordBreaker
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:5e2505d8647542f05843f89ae7cd18e7 discovery persistence spyware stealer
Link:
https://tria.ge/reports/230929-axxdbsgd49/
Behaviour
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Registers COM server for autorun
Downloads MZ/PE file
Modifies Installed Components in the registry
Sets file execution options in registry
Raccoon
Raccoon Stealer payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://128.140.101.125:80/
Unpacked files
SH256 hash:
6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a
MD5 hash:
3f7051e7e2f7bdbe78be54348128c211
SHA1 hash:
599bb8cb50b99f01ff0014ed1a30e87172a88bba
Link:
https://www.unpac.me/results/485ba826-88a0-4b67-b9f0-9237bdc030d3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RaccoonV2
Create hunting rule
Author:ditekSHen
Description:Detects Raccoon Stealer 2.0, also referred to as RecordBreaker
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451851/

Comments