Overview

overview

10

Static

static

Setup.exe

windows7_x64

10

Setup.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Full__Pass__1234.rar
  • Size 6.4MB
  • Sample220629-hpszyahbf5
  • SHA256 8df8a2af174557e9a199b6a35519d510f70c38731a23e38a8586f7f55ba2390a
  • MD5 SHA1 SHA512
Score
10/10
recordbreakerevasionstealertrojan

Malware Config

Extracted

Family

  • recordbreaker

C2

  • http://45.133.216.200/

  • http://45.133.216.71/

Targets

    • Target
      Setup.exe
    • Size 398.7MB
    • SHA256 5eccc045f3cb0a80d82e02ff81fd20ac178c106d44a7751edeaac5d4625d8c0a
    • MD5 SHA1 SHA512
    Score
    10/10
    recordbreakerevasionstealertrojan

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

      stealerrecordbreaker

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks