recordbreaker

General

Target

main_setup_pass_1234.zip
Size

5.9MB
Sample

220620-k7crsabggj
MD5

0e471181646e3d7ac11efc990ed22c08
SHA1

633f59b9c7e28e45ea7144c0ad5aab9195458601
SHA256

71b350eea45226b852a9eb55e9189db53f4dedc00a330da768930f8ccf1d66f9
SHA512

d22d63a4dcde3d48d98549e993a1c325d9884e41978dc4eb4f60f4c21c13dbdc70eb491fdd37785d47dad669832763f9f4d88fae37771660de7718b8e18cee43

Score

10^/10

Malware Config

Extracted

Family

recordbreaker

C2

http://45.142.215.50/

http://45.133.216.170/

Targets

- Target
  
  Main_Setup_Pass_1234/Setup.exe
- Size
  
  428.3MB
- MD5
  
  1aa62bee653e407407ba2c87191f9ff7
- SHA1
  
  d747d0839df7a6f78763ea8fda1b3eb67d09c4cc
- SHA256
  
  dca4ad7e786b93b7dae2735dcc1ddba9977e7ce4c8b5c2e1a952466a916c27a9
- SHA512
  
  ea363fa6740eb37a09ded0270d347a212d29be027f3e09996c8493da4b1afcc2cd495c4c616323884631a35bc4a381a2164eebed04f6c20d97bdbf639c24279d
Score

10^/10

recordbreaker discovery evasion spyware stealer suricata themida trojan
- RecordBreaker
  RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
  stealer recordbreaker
- suricata: ET MALWARE Generic .bin download from Dotted Quad
  suricata: ET MALWARE Generic .bin download from Dotted Quad
  suricata
- suricata: ET MALWARE Generic Stealer Config Download Request
  suricata: ET MALWARE Generic Stealer Config Download Request
  suricata
- suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2