General

  • Target

    data64_4.exe

  • Size

    55KB

  • Sample

    220626-f5gkqsafa4

  • MD5

    b35cde0ed02bf71f1a87721d09746f7b

  • SHA1

    0cf266265f77e387a9d396888651240f2b458e0a

  • SHA256

    47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1

  • SHA512

    59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344

Malware Config

Extracted

Family

recordbreaker

C2

http://51.195.166.184/

Targets

    • Target

      data64_4.exe

    • Size

      55KB

    • MD5

      b35cde0ed02bf71f1a87721d09746f7b

    • SHA1

      0cf266265f77e387a9d396888651240f2b458e0a

    • SHA256

      47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1

    • SHA512

      59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

      suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks