RecordBreaker Stealer

The malware is created when users search for cracks, serial numbers, installers, etc. of commercial software and access the webpage to download and decompress files.

Threat actors distributing infostealers are gaining momentum by targeting victims seeking to illegally download pirated software... fake shareware sites distributing info-stealer malware by targeting victims trying to download pirated software applications.

Since June 17th, the C2s have been responding with settings value that downloads and runs additional malware besides libraries that will be used to steal information.

ThreatLabz researchers found that the padded bytes were irrelevant to running the sample file and determined that threat actor included them to evade detection by security engines.

The malware icons use installer images or those of popular software. In some cases, it may be distributed in a typical packing method by dropper or downloader.

The file also contains Anti-VM and Anti-Debug checks.

Packers are also growing in popularity for the anti-VM and anti-debugging techniques they offer... API calls used for anti-debugging techniques using FindWindow API.

It seems basic targets such as browser cookies, IDs, and passwords are chosen if the related libraries exist.

The targets for stealing in the settings data are mainly strings related to cryptocurrencies such as browser plugin wallets and open source wallets. It seems basic targets such as browser cookies, IDs, and passwords are chosen if the related libraries exist.

It seems basic targets such as browser cookies, IDs, and passwords are chosen if the related libraries exist.

After running, the gathered system information and installed application information is sent back to the C2 server.

The examined instance of RecordBreaker is designed to steal browser information from extensions... using extension IDs provided from the C2 server.

The file also contains Anti-VM and Anti-Debug checks.

The sample steals basic system information, the list of installed programs, screenshots, data saved in browsers, and various cryptocurrency wallet information.

Packers are also growing in popularity for the anti-VM and anti-debugging techniques they offer... API calls used for anti-debugging techniques using FindWindow API.

The sample steals basic system information, the list of installed programs, screenshots, data saved in browsers, and various cryptocurrency wallet information.

scrnsht_Screenshot.jpeg:1

The malware is created when users search for cracks, serial numbers, installers, etc. of commercial software and access the webpage to download and decompress files.

When it first accesses C2, the malware sends the user name, MachineGUID value, and hard-coded key values within the sample and receives the settings data.

When users visit fake shareware sites and click to download, they immediately experience multiple redirects that obfuscate the process for detection by search engines, scanners, and victims, and finally deliver them to a malicious site hosting the threat actor’s intended content. | Once the timeout period is over the loader connects to the remote server requesting a jpg file... once the content is reversed by the malicious program, it transforms into a DLL file.

When the malware is run, it downloads additional libraries depending on the command from C2 (settings value) to collect various sensitive information from the user PC and send it back to C2.