General
-
Target
dc0b3b9b3bdc64d5074f2126ed397258effa721601c645428bcc653b8cdf2f4e
-
Size
2.4MB
-
Sample
220215-f8tz8sbcf5
-
MD5
2ca1fa563d961e96561622edcab5d864
-
SHA1
d9fcd898fe5ddc4a19ae97a6c4ff1f2664a808ac
-
SHA256
dc0b3b9b3bdc64d5074f2126ed397258effa721601c645428bcc653b8cdf2f4e
-
SHA512
916443f39a0e14431b369a6b9c8d37ab12689559f39f3bbd0f9988aa17db2a914c01c9e14cbf7be92146427046e81c76e3dc91f1e767428079c60956e1414b7d
Static task
static1
Behavioral task
behavioral1
Sample
dc0b3b9b3bdc64d5074f2126ed397258effa721601c645428bcc653b8cdf2f4e.exe
Resource
win7-en-20211208
Malware Config
Targets
-
-
Target
dc0b3b9b3bdc64d5074f2126ed397258effa721601c645428bcc653b8cdf2f4e
-
Size
2.4MB
-
MD5
2ca1fa563d961e96561622edcab5d864
-
SHA1
d9fcd898fe5ddc4a19ae97a6c4ff1f2664a808ac
-
SHA256
dc0b3b9b3bdc64d5074f2126ed397258effa721601c645428bcc653b8cdf2f4e
-
SHA512
916443f39a0e14431b369a6b9c8d37ab12689559f39f3bbd0f9988aa17db2a914c01c9e14cbf7be92146427046e81c76e3dc91f1e767428079c60956e1414b7d
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-