Static task
static1
Behavioral task
behavioral1
Sample
data64_4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
data64_4.exe
Resource
win10v2004-20220414-en
General
-
Target
data64_4.exe
-
Size
55KB
-
MD5
b35cde0ed02bf71f1a87721d09746f7b
-
SHA1
0cf266265f77e387a9d396888651240f2b458e0a
-
SHA256
47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1
-
SHA512
59aa3d9c0cbcdbb1d08c563ed322517cd5a52c4dbb039f840a911860c46402304ae889217d1832d5d61af6e080d54d9edfcd3334fc7a8bef2f8f921f232b2344
-
SSDEEP
1536:qzwshK8pUMGxo0xwwW9VemFMGfpbbVDjoANyCa:wwshK8yMexbW9vJVD8ANs
Malware Config
Extracted
recordbreaker
http://51.195.166.184/
Signatures
-
Recordbreaker family
Files
-
data64_4.exe.exe windows x86
4ec5227a81c3e90d891321c143c67557
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynA
GetUserDefaultLCID
GetSystemInfo
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
advapi32
GetUserNameW
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ