Extracted

• • Target

    0bc3aa6b692b3873dfdd6942fb0eaba7aab391f1d154df80be1193aa792df0c2

  • Size

    396.0MB

  • MD5

    b4289cd6faf2c6bfc50970d1368d9e88

  • SHA1

    6ec8e7918a5440dd36d1b6ab08b588aaa6d73c52

  • SHA256

    0bc3aa6b692b3873dfdd6942fb0eaba7aab391f1d154df80be1193aa792df0c2

  • SHA512

    c24fd74542bc29b0c736fbe70b0bb318d02ecf0ec7f01ee7064d284330db94fb254faa4b2a87a5912c088a93eeb1d6609b40c160ce85f8a60342ca373dc18487

  Score

  10^/10

  recordbreakerevasionstealersuricatatrojan

  • Raccoon ver2

    Raccoon ver2.

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2