General
-
Target
mavens[1].bin
-
Size
3.5MB
-
Sample
220215-pq62hsegh7
-
MD5
3c7b73307754a88b0cab311b436b60a6
-
SHA1
44e620b74b4c8df6d66fc2def07f3cea73eb8421
-
SHA256
83895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
-
SHA512
13c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
Static task
static1
Behavioral task
behavioral1
Sample
mavens[1].exe
Resource
win7-en-20211208
Malware Config
Targets
-
-
Target
mavens[1].bin
-
Size
3.5MB
-
MD5
3c7b73307754a88b0cab311b436b60a6
-
SHA1
44e620b74b4c8df6d66fc2def07f3cea73eb8421
-
SHA256
83895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
-
SHA512
13c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-