General
-
Target
SecuriteInfo.com.Trojan.Heur.GM.0000436180.3443.31797
-
Size
8.8MB
-
Sample
201109-zdrej3w3cn
-
MD5
d447c6e8df8fd3b79d1d7e1ec8ad5411
-
SHA1
5226c9f0e797c8fdbf9a7394de7d17052a42ed3f
-
SHA256
5df9d385da1be061f071795513d09110756f4d08f9dc0ed9699206906309f3ba
-
SHA512
9ef34474b53d1dabf3413ea05a7ea02d6c90cb18b3412e2a450dc169fc615df4de13bcfe564d3c86e6881e8f51b22e08fdc96747d20dfdd0f9e1ea0dcc8f3e5a
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Heur.GM.0000436180.3443.31797.exe
Resource
win7v20201028
Malware Config
Targets
-
-
Target
SecuriteInfo.com.Trojan.Heur.GM.0000436180.3443.31797
-
Size
8.8MB
-
MD5
d447c6e8df8fd3b79d1d7e1ec8ad5411
-
SHA1
5226c9f0e797c8fdbf9a7394de7d17052a42ed3f
-
SHA256
5df9d385da1be061f071795513d09110756f4d08f9dc0ed9699206906309f3ba
-
SHA512
9ef34474b53d1dabf3413ea05a7ea02d6c90cb18b3412e2a450dc169fc615df4de13bcfe564d3c86e6881e8f51b22e08fdc96747d20dfdd0f9e1ea0dcc8f3e5a
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-