RecordBreaker Infostealer Disguised as a .NET Installer – ASEC BLOG

Malware that are being distributed disguised as cracks are evolving.

In the past, malware was simply distributed as the executable itself. However, there was a gradual shift towards also including normal files within a compressed file. More recently, there was a sample where a normal installer was downloaded and executed.

If the malware is executed in an ordinary user environment, the encrypted malware file is downloaded from the threat actor’s server and executed. The malware in this instance is the RecordBreaker (Raccoon Stealer V2) Infostealer.

However, in a virtual environment, a .NET update installer is downloaded from the official Microsoft website instead of the malware. After the installer is downloaded, it is then executed and terminated. The following windows may be displayed depending on the installation status of .NET Framework.

Thus, it is highly likely that this file will be categorized as being normal when in analysis environments like sandboxes. It can be seen that the .NET installer has been executed after bypassing the sandboxes of VirusTotal.

The compressed file that is being distributed is managing to deceive users since it also has several normal files and folders compressed inside of it. The figure below shows the files that are created after decompressing the RAR file that was downloaded from the distribution page. Only the “setup.exe” file is the malware while the rest are commonly used files unrelated to the malware.

This particular sample differs from previously distributed malware as it was written in Rust. Furthermore, the file size was not bloated in this distribution, with its size of about 20 to 50 MB. Compared to the previous samples where the file was bloated up to 3 GB, this is much smaller in size.

Additionally, several analysis disruption techniques were applied. The following is a list of the features that have been identified, most of which involve virtual environment detection.

• Scan debugging status
• Scan for strings related to virtual environment in the memory
• Scan PC and user name
• Scan for driver (.sys) related to virtual environment
• Scan file/folder name
• Scan running processes
• System information (Disk size, process information, memory size, etc.)

If not in a virtual environment, a PowerShell command is used to delay the execution before an encrypted malware file is ultimately downloaded from the C2.

C2 : http://89.185.85[.]117/bmlupdate.exe

The file downloaded from the C2 is encrypted with XOR and the key is “Fm6L4G49fGoTN5Qg9vkEqN4THHncGzXRwaaSuzg2PZ8BXqnBHyx9Ppk2oDB3UEcY”.

The downloaded file is decrypted and an injection is carried out after the normal process (addinprocess32.exe) is executed. The decrypted file is the RecordStealer malware and it does not employ any separate packing techniques. However, the code section of the malware contains a significant number of unnecessary API call codes to obstruct analysis.

MD5: 9fed0b55798d1ffd9b44820b3fec080c (Infostealer/Win.RecordStealer, 2023.06.02.03)

If a virtual environment is detected during the above scan process, a normal .NET installer is downloaded from the following address and executed.

hxxps://download,visualstudio,microsoft[,]com/download/pr/1f5af042-d0e4-4002-9c59-9ba66bcf15f6/124d2afe5c8f67dfa910da5f9e3db9c1/ndp472-kb4054531-web,exe

Therefore, the following difference between process trees occurs in virtual environments and normal environments.

The ultimately executed RecordBreaker steals various sensitive information from users according to the configuration value received from the server. It then sends this information to the C2 before terminating itself.

C2: 94.142.138[.]74

User-Agent: Zadanie

More details about RecordBreaker can be found in the post below.

The threat actor is actively creating new variants to bypass detection. Users should avoid using illegal tools such as cracks or keygens and use installers that are officially provided by their developers. In particular, if a file that was downloaded from an unknown website is either a password-protected compressed file or contains an executable with the name setup, activate, or install, it should be treated as suspicious.

AhnLab Security Emergency response Center (ASEC) is thoroughly monitoring malware that is being distributed in this way through an automated system. Relevant information can be confirmed in real-time through the AhnLab TIP service.

[File Detection]

Infostealer/Win.RecordStealer.R579433 (2023.05.19.02)
Infostealer/Win.RecordStealer.R581333 (2023.05.25.03)
Infostealer/Win.Vidar.R582891 (2023.05.30.03)
Infostealer/Win.RecordStealer.R583862 (2023.06.02.03)
Infostealer/Win.RecordStealer.R583865 (2023.06.02.03)

[IOC]

Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.

Source: https://asec.ahnlab.com/en/54658/