General

  • Target

    6dfd4a12437cf38a4ecdb24891dbff464602fcbe435cf6c15a643637d7f4e1b0

  • Size

    7.4MB

  • Sample

    220621-eaqdqaagaq

  • MD5

    7ecdf36bd30c2d9653ea31b6baf32910

  • SHA1

    b1d6c01c397924f2324091261bb4f29156a58f0a

  • SHA256

    6dfd4a12437cf38a4ecdb24891dbff464602fcbe435cf6c15a643637d7f4e1b0

  • SHA512

    1c3402096ab086239e39931c1587ab7c31172faf6307aad396683e0ea7ec6df24f7dbc1b2307fa099fe5d66c592864563217aced68bb9a106978d8b1086b2c88

Malware Config

Targets

    • Target

      6dfd4a12437cf38a4ecdb24891dbff464602fcbe435cf6c15a643637d7f4e1b0

    • Size

      7.4MB

    • MD5

      7ecdf36bd30c2d9653ea31b6baf32910

    • SHA1

      b1d6c01c397924f2324091261bb4f29156a58f0a

    • SHA256

      6dfd4a12437cf38a4ecdb24891dbff464602fcbe435cf6c15a643637d7f4e1b0

    • SHA512

      1c3402096ab086239e39931c1587ab7c31172faf6307aad396683e0ea7ec6df24f7dbc1b2307fa099fe5d66c592864563217aced68bb9a106978d8b1086b2c88

    • Raccoon ver2

      Raccoon ver2.

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks