General
-
Target
data64_4.exe
-
Size
55KB
-
Sample
220626-f5gkqsafa4
-
MD5
b35cde0ed02bf71f1a87721d09746f7b
-
SHA1
0cf266265f77e387a9d396888651240f2b458e0a
-
SHA256
47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1
-
SHA512
59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344
Static task
static1
Behavioral task
behavioral1
Sample
data64_4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
data64_4.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
recordbreaker
http://51.195.166.184/
Targets
-
-
Target
data64_4.exe
-
Size
55KB
-
MD5
b35cde0ed02bf71f1a87721d09746f7b
-
SHA1
0cf266265f77e387a9d396888651240f2b458e0a
-
SHA256
47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1
-
SHA512
59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344
Score10/10-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-