recordbreaker

General

Target

Setup.exe
Size

388.5MB
Sample

220622-yrcnqsachm
MD5

9c25f4974604a5f756b5b5ba55c13d38
SHA1

039be44cb40164a48a3ef22f7b9065505822bb0d
SHA256

580f7f0a85ddab4f515ba5d6cf07d05161763bbc46a4ced8e5bc4b0f45ae8a9a
SHA512

36778423d84ad133e71cea556a0d9f67a2144c6f5f1fe0c7d6875f22d61b46f3c5c23351d74e2f65867ecc9ed9b65326ad63c510099b4c68967a21673a8847f6

Score

10^/10

Malware Config

Extracted

Family

recordbreaker

C2

http://45.67.34.152/

http://45.133.216.249/

Targets

- Target
  
  Setup.exe
- Size
  
  388.5MB
- MD5
  
  9c25f4974604a5f756b5b5ba55c13d38
- SHA1
  
  039be44cb40164a48a3ef22f7b9065505822bb0d
- SHA256
  
  580f7f0a85ddab4f515ba5d6cf07d05161763bbc46a4ced8e5bc4b0f45ae8a9a
- SHA512
  
  36778423d84ad133e71cea556a0d9f67a2144c6f5f1fe0c7d6875f22d61b46f3c5c23351d74e2f65867ecc9ed9b65326ad63c510099b4c68967a21673a8847f6
Score

10^/10

recordbreaker discovery evasion spyware stealer suricata themida trojan
- RecordBreaker
  RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
  stealer recordbreaker
- suricata: ET MALWARE Generic .bin download from Dotted Quad
  suricata: ET MALWARE Generic .bin download from Dotted Quad
  suricata
- suricata: ET MALWARE Generic Stealer Config Download Request
  suricata: ET MALWARE Generic Stealer Config Download Request
  suricata
- suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2