Extracted

• • Target

    fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74

  • Size

    279KB

  • MD5

    e8a3b9038499e57efa0fac179995c4eb

  • SHA1

    4584bea5ef3c4d6dd4de7bc1162ab5a3000cf6d1

  • SHA256

    fd0fadecf054fd384b0964b72331387a79d621a90383706838713f086d12ee74

  • SHA512

    063874174ab32f003a26bdf2ee7651e7ff08eeac21bcc8f122a25b840f8901fbcf6ed8289f321e817bc507a86cc54b9c8e715ccc00de12735022723175d28b13

  Score

  10^/10

  recordbreakerredlinemario2infostealerspywarestealersuricata

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1