Extracted

• • Target

    setup/Pre-Activated-FullSetup.exe

  • Size

    428.2MB

  • MD5

    14027e925ba400d5d3c85269bfb85196

  • SHA1

    73e374955b569a9aaa7a0cd37ffdd9b95740a2f0

  • SHA256

    86d508d420ebd5516b7c9b0f339357a191340d7fd6ae47cd1fb43f3649d8a556

  • SHA512

    8fbd8df47b0359694fa6d0956cc4e5fd75316313a5c7aaef5214e61c1662a0d7755ecc19a453cd43feddb3e53ea8fcfe346b5f19c2501590607d004002749fa8

  Score

  10^/10

  recordbreakerdiscoveryevasionspywarestealersuricatathemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    setup/Setup-Crack.exe

  • Size

    428.2MB

  • MD5

    49a39ad81be36f89ba9f49f69f943e17

  • SHA1

    3e56f28082e2f2fb2d96406392e6c26304f1961d

  • SHA256

    c6b12597fb67318044f589badb24859544cafc6b53bba4ae9ea9f80d856c8d15

  • SHA512

    36ec98255a9b277740530728adb0a21aa55192565c4ba0dd8f44e8e09bc5c1a519f5108a006baed366cdc3504d81425a44aba266f8bf43f18353d278e31115eb

  Score

  10^/10

  recordbreakerevasionstealerthemidatrojandiscoveryspywaresuricata

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata: ET MALWARE Generic .bin download from Dotted Quad

    suricata

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4