Extracted

• • Target
    setup/AISetup.exe
  • Size 465.0MB
  • SHA256 07cc8639fd86e1d80e664ff18a2f45f163b736f0bd28a2b166a00c0733d656dd
  • MD5 e729c14e3ba0a6eff92196a8047c3a08
  • SHA1 5c27015b56dcc63b058518a5bf9d7535354ebe9b
  • SHA512 45a00dc294626e68a9f2ca0a183a2c24e2aaa778eadd5d2a76ba2814d6886f73196a605e2e23fce3d5efb701da1c9af967560a8a3d01556d4ea2ad2b6540b53d
  • MD5 SHA1 SHA512

  Score

  10^/10

  recordbreakerevasionstealersuricatathemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    setup/Pre-Activated-Setup.exe
  • Size 465.0MB
  • SHA256 00a7d52ecb3440aaceabcad78feda2eb9bb94e7431ca32a2dc799f9031b51e1c
  • MD5 3e2d0c1798a20041337629893cb2b2ea
  • SHA1 9cdecbd7cbd1ba85383e5ede6208fdd905d254b8
  • SHA512 597e58a01f3d5e87fcb76384a8efb7af4f0e143a656506d9c572e5c73a851ec4138c0e82e36095c7dbfdf347ba0b306b1dc5cdddf5b84a2aae27d64b8be07deb
  • MD5 SHA1 SHA512

  Score

  10^/10

  recordbreakerevasionstealerthemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4