General
-
Target
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
-
Size
3.4MB
-
Sample
220120-n4yrmahhbk
-
MD5
6b73040840cf675d89f95e643476ce10
-
SHA1
04b5c30cdb12d2f271e7111bb1e3b7f25927642b
-
SHA256
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
-
SHA512
041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
Static task
static1
Behavioral task
behavioral1
Sample
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
-
Size
3.4MB
-
MD5
6b73040840cf675d89f95e643476ce10
-
SHA1
04b5c30cdb12d2f271e7111bb1e3b7f25927642b
-
SHA256
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
-
SHA512
041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-