General
-
Target
12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844.zip
-
Size
1.1MB
-
Sample
201204-mvr8kgde2x
-
MD5
9500b7cede59ed11e7b4230af30129cd
-
SHA1
ff8f9ec4f0002c05a8a711e082e34d2dd6ac3442
-
SHA256
cd8e4bcf668b73c91251c6df4d2dc3f6abd24f67b0272ef8236b8147eb822200
-
SHA512
2070042f4cf84e2dee07f304848be8353cdf98a59c3f2c34a798cd9605fc0204a6c27c9b4b7d7ff9bdd411ff2a4b7c1e2b0c8ecd0fc1b5db9f0d2f422fb011de
Static task
static1
Behavioral task
behavioral1
Sample
12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844
-
Size
1.1MB
-
MD5
71169e2bb6e19b3c3edcd7d8f3d6d3f1
-
SHA1
5bfa1d6c520f1fc1399075451e7041710892f831
-
SHA256
12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844
-
SHA512
d32037f299a25982a3373e967926763ee8c2cbc6300117a706c38f3a1d81cbbb15b3168398bf3e1a4cf9a14f551c344ff81dbd9dc6543dbc0ca9dd901a3612f6
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-