Extracted

• • Target

    a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45

  • Size

    227KB

  • MD5

    50d681b70823812ed7a9bed0e0c7da16

  • SHA1

    cdbae43b6289b7f1b7c8f34dc68aafacd44162da

  • SHA256

    a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45

  • SHA512

    057684fd30e543a439325eadc2cbf1705eb0a4db9e756c8ca3c817ce22e7fe58a5bfd7408e52949bb2ea876797f7ed29559c2a33346f20bd73bb65af7601d662

  Score

  10^/10

  recordbreakerredlinemario2infostealerspywarestealersuricata

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1