General
-
Target
f460acfcc99c9338b3f5fb3793f6cbb15daf76c2a79fd05f7398af5346150801
-
Size
2.6MB
-
Sample
220117-ed2k6aghdr
-
MD5
1d00723292d3b8bda50c59d040c27087
-
SHA1
76aedfcff7e298d862354db00ee2c4575da72b42
-
SHA256
f460acfcc99c9338b3f5fb3793f6cbb15daf76c2a79fd05f7398af5346150801
-
SHA512
03ef6b83ccff99155be15ca8ac83bb2ada8570a1f5dfbf983db7c6fc6220ca8aa1555988dc72fb08a39ac6d73f8c77c75cdd875249912f9db720a2d5bcbad76a
Static task
static1
Malware Config
Extracted
cryptbot
zyoyol62.top
morpsy06.top
-
payload_url
http://yapcbx08.top/download.php?file=inrhed.exe
Targets
-
-
Target
f460acfcc99c9338b3f5fb3793f6cbb15daf76c2a79fd05f7398af5346150801
-
Size
2.6MB
-
MD5
1d00723292d3b8bda50c59d040c27087
-
SHA1
76aedfcff7e298d862354db00ee2c4575da72b42
-
SHA256
f460acfcc99c9338b3f5fb3793f6cbb15daf76c2a79fd05f7398af5346150801
-
SHA512
03ef6b83ccff99155be15ca8ac83bb2ada8570a1f5dfbf983db7c6fc6220ca8aa1555988dc72fb08a39ac6d73f8c77c75cdd875249912f9db720a2d5bcbad76a
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-