General
-
Target
66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767
-
Size
2.7MB
-
Sample
220111-f9bkaafcdp
-
MD5
459b0f64c3cb635a03af588adcb98077
-
SHA1
af3573b5a9ae95d061bb2c0f262a7759b6d8c309
-
SHA256
66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767
-
SHA512
17a53247ea4514c66abb01cecdc44919d768905df56eb6a15361b84c7ea07edc329f48b266406997b40e218cc28ad26b3d295eb55067aa92c3d85e4573b8457a
Static task
static1
Malware Config
Extracted
cryptbot
kotbri22.top
moruzj02.top
-
payload_url
http://okavor03.top/download.php?file=acaboa.exe
Targets
-
-
Target
66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767
-
Size
2.7MB
-
MD5
459b0f64c3cb635a03af588adcb98077
-
SHA1
af3573b5a9ae95d061bb2c0f262a7759b6d8c309
-
SHA256
66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767
-
SHA512
17a53247ea4514c66abb01cecdc44919d768905df56eb6a15361b84c7ea07edc329f48b266406997b40e218cc28ad26b3d295eb55067aa92c3d85e4573b8457a
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-