General
- Target e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad
- Size 6.7MB
- Sample201008-34xyn95xde
- SHA256 e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad
Score
9/10
Malware Config
Targets
-
- Target e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad
- Size 6.7MB
- SHA256 e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad
Score9/10Identifies VirtualBox via ACPI registry values (likely anti-VM)
ServiceHost packer
Detects ServiceHost packer used for .NET malware
Blacklisted process makes network request
Executes dropped EXE
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Loads dropped DLL
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
JavaScript code in executable
Modifies service
Suspicious use of SetThreadContext