General
-
Target
69a3d152861a94a8c8cf69faf4e1dfd7
-
Size
5.4MB
-
Sample
211202-za94caegh5
-
MD5
69a3d152861a94a8c8cf69faf4e1dfd7
-
SHA1
449ae90ea454a76a546c0650e87697b757bfc0b8
-
SHA256
b871a7103ea085957ad02ae4983b13e7c1990eb0c2fbc360395e3dfb72e736ab
-
SHA512
78605a6661e4586646d30d52ab7fd5beb5945e2b712f91b431c29326c5be39dab37a1a7c7f29782f18c11038387c53dde18344cd2e2d8c93a64ccc78d200170b
Static task
static1
Behavioral task
behavioral1
Sample
69a3d152861a94a8c8cf69faf4e1dfd7.exe
Resource
win7-en-20211104
Malware Config
Targets
-
-
Target
69a3d152861a94a8c8cf69faf4e1dfd7
-
Size
5.4MB
-
MD5
69a3d152861a94a8c8cf69faf4e1dfd7
-
SHA1
449ae90ea454a76a546c0650e87697b757bfc0b8
-
SHA256
b871a7103ea085957ad02ae4983b13e7c1990eb0c2fbc360395e3dfb72e736ab
-
SHA512
78605a6661e4586646d30d52ab7fd5beb5945e2b712f91b431c29326c5be39dab37a1a7c7f29782f18c11038387c53dde18344cd2e2d8c93a64ccc78d200170b
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-