General
-
Target
567bd8dd69485d8f79edad514e54c085af1490dcc5461a01ee79e57e138b9b10
-
Size
2.6MB
-
Sample
220621-dy6j6scef2
-
MD5
e3a845bd8c0bf6f44104f8e31216929a
-
SHA1
e94f44c5c4aee2987c1e912b1616ef5ab316a8da
-
SHA256
567bd8dd69485d8f79edad514e54c085af1490dcc5461a01ee79e57e138b9b10
-
SHA512
2ecebc4bd993a8f2d2adee95128131b9de07827a6724af9324843e554126bd4764543d192074bcace88a033d6b0593adf3b5289623e7f6998566bcc77900718b
Malware Config
Extracted
recordbreaker
http://91.240.84.222/
Targets
-
-
Target
567bd8dd69485d8f79edad514e54c085af1490dcc5461a01ee79e57e138b9b10
-
Size
2.6MB
-
MD5
e3a845bd8c0bf6f44104f8e31216929a
-
SHA1
e94f44c5c4aee2987c1e912b1616ef5ab316a8da
-
SHA256
567bd8dd69485d8f79edad514e54c085af1490dcc5461a01ee79e57e138b9b10
-
SHA512
2ecebc4bd993a8f2d2adee95128131b9de07827a6724af9324843e554126bd4764543d192074bcace88a033d6b0593adf3b5289623e7f6998566bcc77900718b
Score10/10-
Raccoon ver2
Raccoon ver2.
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-