General
-
Target
88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8
-
Size
3.3MB
-
Sample
220215-kawtdscgc3
-
MD5
0dfeb3b51850fc533a34dbc310b87102
-
SHA1
29d424a7ad1be8cd11b29f51cc73b871f5ed48ee
-
SHA256
88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8
-
SHA512
7e34a418fb13ba6bb6e4f68c13c1fcc9911935f7226b63191eab36417166076a72a6d28a8b40ebee68d58d40ebd69057fd3e5d8b45d46b11366d8edf360457a6
Static task
static1
Behavioral task
behavioral1
Sample
88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8.exe
Resource
win7-en-20211208
Malware Config
Targets
-
-
Target
88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8
-
Size
3.3MB
-
MD5
0dfeb3b51850fc533a34dbc310b87102
-
SHA1
29d424a7ad1be8cd11b29f51cc73b871f5ed48ee
-
SHA256
88d6f62deff34565e1b0272f1554824091b2476af8e6f386647f6b85e7c9a2e8
-
SHA512
7e34a418fb13ba6bb6e4f68c13c1fcc9911935f7226b63191eab36417166076a72a6d28a8b40ebee68d58d40ebd69057fd3e5d8b45d46b11366d8edf360457a6
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-