General
-
Target
ea42501417b7f05736d1af9d20b087a3a8742990aa7e3852d1ed1681dc4af8e3
-
Size
405KB
-
Sample
211207-f853haahd4
-
MD5
144a2031897a0e34e3b1d9d47620cb77
-
SHA1
d10c50f23dcc7aa545cd532a01305f79292556cb
-
SHA256
ea42501417b7f05736d1af9d20b087a3a8742990aa7e3852d1ed1681dc4af8e3
-
SHA512
d57b6deaddd1607cc7074d6e6a6e5f599ebe6653bbef523a12194e98d8c3e406fc059c5651553c71f3aaac1facb9b2625a30ed131130ed358654c199eb52dfd4
Static task
static1
Malware Config
Extracted
cryptbot
gomcds22.top
morbuq02.top
-
payload_url
http://peuocu14.top/download.php?file=tauten.exe
Targets
-
-
Target
ea42501417b7f05736d1af9d20b087a3a8742990aa7e3852d1ed1681dc4af8e3
-
Size
405KB
-
MD5
144a2031897a0e34e3b1d9d47620cb77
-
SHA1
d10c50f23dcc7aa545cd532a01305f79292556cb
-
SHA256
ea42501417b7f05736d1af9d20b087a3a8742990aa7e3852d1ed1681dc4af8e3
-
SHA512
d57b6deaddd1607cc7074d6e6a6e5f599ebe6653bbef523a12194e98d8c3e406fc059c5651553c71f3aaac1facb9b2625a30ed131130ed358654c199eb52dfd4
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-