General

  • Target

    c6f111e1b32229232af8af25d714ef8f77e30bbc122c0600076bb42cbe46e22b

  • Size

    2.2MB

  • Sample

    220621-eafjhschc4

  • MD5

    e8859c17022fd17a9d4950a2f0752f73

  • SHA1

    b8778988a5996c8e9eaca47e41cbfc185a37cc6e

  • SHA256

    c6f111e1b32229232af8af25d714ef8f77e30bbc122c0600076bb42cbe46e22b

  • SHA512

    c9c367bf290d94548851965ac554fffb1ce14de71685dfd3480d8a1a50534a39b3fd937bc25739136ccd6d8d44f95793ed634eb3d6c31ada4fec868af0c45e3c

Malware Config

Extracted

Family

recordbreaker

C2

http://45.9.150.158/

Targets

    • Target

      c6f111e1b32229232af8af25d714ef8f77e30bbc122c0600076bb42cbe46e22b

    • Size

      2.2MB

    • MD5

      e8859c17022fd17a9d4950a2f0752f73

    • SHA1

      b8778988a5996c8e9eaca47e41cbfc185a37cc6e

    • SHA256

      c6f111e1b32229232af8af25d714ef8f77e30bbc122c0600076bb42cbe46e22b

    • SHA512

      c9c367bf290d94548851965ac554fffb1ce14de71685dfd3480d8a1a50534a39b3fd937bc25739136ccd6d8d44f95793ed634eb3d6c31ada4fec868af0c45e3c

    • Raccoon ver2

      Raccoon ver2.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks