General
-
Target
4417fe6510eaaf8d7abdbbf016667b39ba073638befe7c7e099cb929b6bb36e6
-
Size
3.0MB
-
Sample
210926-xnl8bsfbek
-
MD5
396c1fee45927fc296c636b9748c754b
-
SHA1
006697abdfde55b895b412158c312099d5c20e66
-
SHA256
4417fe6510eaaf8d7abdbbf016667b39ba073638befe7c7e099cb929b6bb36e6
-
SHA512
122eb5a5d3e3994e1f10b7d16668c9f46380f51aa574e072fa9f68427907341f4809d82d3d5f3de81f3be8e893a3f5c15bcf8c7b2ea3fbcaaf2ef2a74bbb5409
Static task
static1
Malware Config
Targets
-
-
Target
4417fe6510eaaf8d7abdbbf016667b39ba073638befe7c7e099cb929b6bb36e6
-
Size
3.0MB
-
MD5
396c1fee45927fc296c636b9748c754b
-
SHA1
006697abdfde55b895b412158c312099d5c20e66
-
SHA256
4417fe6510eaaf8d7abdbbf016667b39ba073638befe7c7e099cb929b6bb36e6
-
SHA512
122eb5a5d3e3994e1f10b7d16668c9f46380f51aa574e072fa9f68427907341f4809d82d3d5f3de81f3be8e893a3f5c15bcf8c7b2ea3fbcaaf2ef2a74bbb5409
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-