Extracted

• • Target

    setup/AISetup.exe

  • Size

    465.0MB

  • MD5

    e729c14e3ba0a6eff92196a8047c3a08

  • SHA1

    5c27015b56dcc63b058518a5bf9d7535354ebe9b

  • SHA256

    07cc8639fd86e1d80e664ff18a2f45f163b736f0bd28a2b166a00c0733d656dd

  • SHA512

    45a00dc294626e68a9f2ca0a183a2c24e2aaa778eadd5d2a76ba2814d6886f73196a605e2e23fce3d5efb701da1c9af967560a8a3d01556d4ea2ad2b6540b53d

  Score

  10^/10

  recordbreakerevasionstealersuricatathemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    setup/Pre-Activated-Setup.exe

  • Size

    465.0MB

  • MD5

    3e2d0c1798a20041337629893cb2b2ea

  • SHA1

    9cdecbd7cbd1ba85383e5ede6208fdd905d254b8

  • SHA256

    00a7d52ecb3440aaceabcad78feda2eb9bb94e7431ca32a2dc799f9031b51e1c

  • SHA512

    597e58a01f3d5e87fcb76384a8efb7af4f0e143a656506d9c572e5c73a851ec4138c0e82e36095c7dbfdf347ba0b306b1dc5cdddf5b84a2aae27d64b8be07deb

  Score

  10^/10

  recordbreakerevasionstealerthemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4