General
-
Target
e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d
-
Size
2.8MB
-
Sample
220211-c24djsbebl
-
MD5
e066ff0c7010232f1059d0398dc2c720
-
SHA1
320d69f502460a590679e4ac35309df0f0707216
-
SHA256
e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d
-
SHA512
852cf674c9ecd9586e9355a0558d97feec59669bee9270a1dcb7906976e13d9514afa0974ec2bcec9aa68d14b603f15b4f6b18d252720afba17eafcbe86cc88d
Static task
static1
Behavioral task
behavioral1
Sample
e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d.exe
Resource
win7-en-20211208
Malware Config
Extracted
cryptbot
zyoksv12.top
morlea01.top
-
payload_url
http://yapivt01.top/download.php?file=ainger.exe
Targets
-
-
Target
e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d
-
Size
2.8MB
-
MD5
e066ff0c7010232f1059d0398dc2c720
-
SHA1
320d69f502460a590679e4ac35309df0f0707216
-
SHA256
e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d
-
SHA512
852cf674c9ecd9586e9355a0558d97feec59669bee9270a1dcb7906976e13d9514afa0974ec2bcec9aa68d14b603f15b4f6b18d252720afba17eafcbe86cc88d
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-