Rewterz Threat Update –New Lightweight Method Reliably Identifies Obscure iOS Spyware
January 22, 2024Rewterz Threat Alert –APT28 FancyBear Group – Active IOCs
January 23, 2024Rewterz Threat Update –New Lightweight Method Reliably Identifies Obscure iOS Spyware
January 22, 2024Rewterz Threat Alert –APT28 FancyBear Group – Active IOCs
January 23, 2024Severity
High
Analysis Summary
RecordBreaker is a type of malware that is designed to steal personal information from infected computers. This can include sensitive information such as login credentials, credit card numbers, and other financial data. RecordBreaker malware is the successor of Raccoon Stealer (also known as Raccoon Stealer 2.0), although it is a complete rewrite in C/C++. The malware is typically spread through phishing emails, malicious websites, or infected software downloads. Once installed on a computer, RecordBreaker can run in the background and collect information without the user’s knowledge. It can also open backdoors to allow hackers to remotely access the infected computer and steal information or install additional malware. To protect against RecordBreaker and other types of malware, it is important to use a reputable antivirus program and be cautious when clicking on links or downloading software from untrusted sources.
Impact
- Data Exfiltration
- Credential Theft
- Financial Loss
Indicators of Compromise
Domain Name
- restfork.website
- antsmemory.xyz
MD5
- 0ba85c9605746970c7b706309a378a91
- 641d6655a3e29cc7614c8b957862e1c4
- 57e411788e7ed9ab4770b03eb026533b
- 3d6f88c2670e52d69d05db9ca2cc0322
- 2800086d1e1bc2bfc3fd70f888baa391
SHA-256
- ea73a244dd2241a9f7c8981bd314638a829c2a0f38200b8ffce71de039dbc510
- c059b783b68ef84c1743e29fc176231e88de977eddb9b78a92c2327a811875c6
- 0d79b46f4c9e6f78c0655e3b2a6dd2a0f7b47db44513d0165d710823f755b18b
- bb4d7cd815700d90e229d1d6fa672b46842b66ffede6981d63f67af0cb99a0f8
- 61487917009bbcc5f0dac7840265060f070adc22139fbab964a37cd68b7779c4
SHA-1
- 70056237d11dc73b3db6d2a8ae1bf6b3b4dedc4e
- 62e64aa2c9350b595d464a9b86b7523c908b89f5
- cb738621cb2de627804579d5071e372b286d2220
- 62886ea7e99e0f7048d2fffc36a15b53e9033ea5
- ace5ca715f0279a9290e55c4ebc0988457446d6a
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Ensure that general security policies are employed including implementing strong passwords, correct configurations, and proper administration security policies.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.
- Never open links or attachments from unknown senders.