Extracted

• • Target

    196ecaabd29b61e93823bf31e5e69c9c1159c413f1e0325babba4473d95c2a8b

  • Size

    4.5MB

  • MD5

    198509a8a53fdfe1c9b5d7fa936d895c

  • SHA1

    c0f78237d3d814de81f6d0f11e0d092d0b990523

  • SHA256

    196ecaabd29b61e93823bf31e5e69c9c1159c413f1e0325babba4473d95c2a8b

  • SHA512

    0b017aed1b0121706570b63c3103da759b21da94492a60a7c975c5a21c8888a84042d7210f1b9109cc7403c41d416c795e032cfd97c4123fdc3212992fccbd18

  Score

  10^/10

  recordbreakerevasionstealersuricatathemidatrojanvmprotect

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

    suricata

  • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2