Extracted

• • Target

    Server.exe

  • Size

    449KB

  • MD5

    4682b50369a41924c08401249ccb8511

  • SHA1

    364062cce5ed118a6b3ddce1af5e726778cbb7d6

  • SHA256

    729e7368bb7e28a5416896392bfed2f738804cb7d957c58e78a90a771ce4f976

  • SHA512

    d7206a2d97da4f0c7ee854d0c7dbd514bfd9919159290ea25464dc6c0fe1a2a3009568fc94e37498dcadc8121fd5d4b2520cc604de229163528d3041222adfaf

  Score

  10^/10

  recordbreakerdiscoveryevasionpersistencestealerthemidatrojan

  • Modifies system executable filetype association

    persistence

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • evasion

    evasion.

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3behavioral4