General
-
Target
fl.exe
-
Size
1.3MB
-
Sample
220123-vxkpragcd7
-
MD5
c607b8bf42f152de754d361bae337bdc
-
SHA1
642fdb6a3aef4b82056a4fd69af925622188b78a
-
SHA256
e399e3fc1f94f17e12ff0c16f8246523cce8b45c27e6c9b8d484e26dbb94b10a
-
SHA512
a89bef28c045dbfaf884ceebdbf30ceb9bc1ccc5c8ff4fa4aed78c74c436e65d987c5de40e44161ff3bd476bce9fa7fc6ce63483198ee7c96b310877c566fdd7
Static task
static1
Behavioral task
behavioral1
Sample
fl.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fl.exe
Resource
win10-en-20211208
Malware Config
Targets
-
-
Target
fl.exe
-
Size
1.3MB
-
MD5
c607b8bf42f152de754d361bae337bdc
-
SHA1
642fdb6a3aef4b82056a4fd69af925622188b78a
-
SHA256
e399e3fc1f94f17e12ff0c16f8246523cce8b45c27e6c9b8d484e26dbb94b10a
-
SHA512
a89bef28c045dbfaf884ceebdbf30ceb9bc1ccc5c8ff4fa4aed78c74c436e65d987c5de40e44161ff3bd476bce9fa7fc6ce63483198ee7c96b310877c566fdd7
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-