General
-
Target
3276687dad3c0a8d82bd752b2591c7d0b89c823a2e9761b4db8c95e9cd842f81
-
Size
2.7MB
-
Sample
211220-snjpzsahg3
-
MD5
af36c20219a8f5fa58d205a9e5db1cc1
-
SHA1
17356b91dd8292bddea7300c3a9fc1a98fccd11f
-
SHA256
3276687dad3c0a8d82bd752b2591c7d0b89c823a2e9761b4db8c95e9cd842f81
-
SHA512
443ba7a6c07ee2076f823a5a70ef6dffb60e5f36dc413672f8194e6e46abcb47dc364812f2b2b76e1da914e8d64322111cc78e7875608c205a5331302ecc1e4e
Static task
static1
Malware Config
Targets
-
-
Target
3276687dad3c0a8d82bd752b2591c7d0b89c823a2e9761b4db8c95e9cd842f81
-
Size
2.7MB
-
MD5
af36c20219a8f5fa58d205a9e5db1cc1
-
SHA1
17356b91dd8292bddea7300c3a9fc1a98fccd11f
-
SHA256
3276687dad3c0a8d82bd752b2591c7d0b89c823a2e9761b4db8c95e9cd842f81
-
SHA512
443ba7a6c07ee2076f823a5a70ef6dffb60e5f36dc413672f8194e6e46abcb47dc364812f2b2b76e1da914e8d64322111cc78e7875608c205a5331302ecc1e4e
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-