Overview

overview

10

Static

static

winprofile

windows7_x64

10

winprofile

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

  • Size

    1.1MB

  • Sample

    220621-dzbfesceg2

  • MD5

    c3f533c47a2f995cd4b5d16653698609

  • SHA1

    223cfb523ff8b64b339a34db3808dc6a386752a4

  • SHA256

    672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

  • SHA512

    6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

Score
10/10
arkeirecordbreakerdefaultstealer

Malware Config

Extracted

Family

recordbreaker

C2

http://192.248.184.34/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

    • Size

      1.1MB

    • MD5

      c3f533c47a2f995cd4b5d16653698609

    • SHA1

      223cfb523ff8b64b339a34db3808dc6a386752a4

    • SHA256

      672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

    • SHA512

      6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

    Score
    10/10
    arkeirecordbreakerdefaultstealer

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • Raccoon ver2

      Raccoon ver2.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

      stealerrecordbreaker

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks