General
-
Target
02_extracted.exe
-
Size
249KB
-
Sample
201206-p73rmkh8yj
-
MD5
616c9a9f34da87b771f7aa1533b4d7c7
-
SHA1
35b7dc70fe7ea8bba8284352bad4f937d3541caf
-
SHA256
b3a38651e8b31844393d1252c7a78aac1eda5656c94ff93f17062c66cc961ac3
-
SHA512
d8a5ec2e0b4eb5c008defb883c7423288fe9119ca9ed70fbfc06b35a616ab48f95bf758802485a08296a7d8cb0836bdde0a3bb86cca979bcd783b091af6e19a4
Static task
static1
Behavioral task
behavioral1
Sample
02_extracted.exe
Resource
win7v20201028
Malware Config
Targets
-
-
Target
02_extracted.exe
-
Size
249KB
-
MD5
616c9a9f34da87b771f7aa1533b4d7c7
-
SHA1
35b7dc70fe7ea8bba8284352bad4f937d3541caf
-
SHA256
b3a38651e8b31844393d1252c7a78aac1eda5656c94ff93f17062c66cc961ac3
-
SHA512
d8a5ec2e0b4eb5c008defb883c7423288fe9119ca9ed70fbfc06b35a616ab48f95bf758802485a08296a7d8cb0836bdde0a3bb86cca979bcd783b091af6e19a4
-
Modifies WinLogon for persistence
-
NetWire RAT payload
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-