General
-
Target
a48e59e86ef8e4dd072c9e2bdd5d98cb7bba33bdd11f1726cb2bfd0bd6960a8c
-
Size
2.7MB
-
Sample
211210-gvg9ysfef9
-
MD5
f13d185dc317590533ffc8f1dd7b0402
-
SHA1
531ffabcc8dfb1f299934124f0fe762af01cd41f
-
SHA256
a48e59e86ef8e4dd072c9e2bdd5d98cb7bba33bdd11f1726cb2bfd0bd6960a8c
-
SHA512
eb9af20eac795038b7c1cad39e259761a0f6f8454bc114bf6d0148fd723388c38ed94f8f739dcda1f85ea0b6dfae766d78f48f0e04f2a7f174f4b6ee8841e605
Static task
static1
Malware Config
Targets
-
-
Target
a48e59e86ef8e4dd072c9e2bdd5d98cb7bba33bdd11f1726cb2bfd0bd6960a8c
-
Size
2.7MB
-
MD5
f13d185dc317590533ffc8f1dd7b0402
-
SHA1
531ffabcc8dfb1f299934124f0fe762af01cd41f
-
SHA256
a48e59e86ef8e4dd072c9e2bdd5d98cb7bba33bdd11f1726cb2bfd0bd6960a8c
-
SHA512
eb9af20eac795038b7c1cad39e259761a0f6f8454bc114bf6d0148fd723388c38ed94f8f739dcda1f85ea0b6dfae766d78f48f0e04f2a7f174f4b6ee8841e605
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-