General

  • Target

    7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9

  • Size

    181KB

  • Sample

    220621-dyz3dscee3

  • MD5

    ef18473cf2e8162c5671981437cf00a6

  • SHA1

    0c85d6bf85611292c76331d7cc6690014a869fb6

  • SHA256

    7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9

  • SHA512

    fce1eb3ef6679ef97d7b1f76192c1195925e3c288c0097dda4ace87e0d610c1fc9cf5fcc7fd148986d5770e1e63ff2803e8072b4e1624007f12e60184cad0375

Malware Config

Extracted

Family

recordbreaker

C2

http://77.91.73.162/

Targets

    • Target

      7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9

    • Size

      181KB

    • MD5

      ef18473cf2e8162c5671981437cf00a6

    • SHA1

      0c85d6bf85611292c76331d7cc6690014a869fb6

    • SHA256

      7503d528db92b909ad05d65379e6aae008dfaa3664bcac252d34d7a9f25b2db9

    • SHA512

      fce1eb3ef6679ef97d7b1f76192c1195925e3c288c0097dda4ace87e0d610c1fc9cf5fcc7fd148986d5770e1e63ff2803e8072b4e1624007f12e60184cad0375

    • Raccoon ver2

      Raccoon ver2.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks