Extracted

• • Target

    9d66a6a6823aea1b923f0c200dfecb1ae70839d955e11a3f85184b8e0b16c6f8

  • Size

    407.2MB

  • MD5

    945240b56128fb9b334ca47726b0a87e

  • SHA1

    0a5bbfb80c04c7c832c29be1557818488a1a54d9

  • SHA256

    9d66a6a6823aea1b923f0c200dfecb1ae70839d955e11a3f85184b8e0b16c6f8

  • SHA512

    6fdf319e3fed59e23784b4961b2c5d15bd94c6176c41b7087d996afa95fd7f8397639efb389f267d46f436fe2fb0cf180ff512c34f5a86a7498724f6f7065cfd

  Score

  10^/10

  recordbreakerevasionstealertrojan

  • Raccoon ver2

    Raccoon ver2.

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2