General
-
Target
333acbfe28976ee28514bb425c2c461026572d0003a7378fba366716e408d822
-
Size
3.3MB
-
Sample
220215-rsnztshbcq
-
MD5
a5f561f29f736a1f99ef726773628fa3
-
SHA1
acf172fa11ee345a6041784ef9f1021307f598dd
-
SHA256
333acbfe28976ee28514bb425c2c461026572d0003a7378fba366716e408d822
-
SHA512
ff75d12f607e407d190802be88f319cc6750f3898bc411199f3fd6976e24ed55296fed7ef562f97cbeb61cb1c0b3b635fba999c0780561c2f5a1b88d2b56160c
Static task
static1
Behavioral task
behavioral1
Sample
333acbfe28976ee28514bb425c2c461026572d0003a7378fba366716e408d822.exe
Resource
win7-en-20211208
Malware Config
Targets
-
-
Target
333acbfe28976ee28514bb425c2c461026572d0003a7378fba366716e408d822
-
Size
3.3MB
-
MD5
a5f561f29f736a1f99ef726773628fa3
-
SHA1
acf172fa11ee345a6041784ef9f1021307f598dd
-
SHA256
333acbfe28976ee28514bb425c2c461026572d0003a7378fba366716e408d822
-
SHA512
ff75d12f607e407d190802be88f319cc6750f3898bc411199f3fd6976e24ed55296fed7ef562f97cbeb61cb1c0b3b635fba999c0780561c2f5a1b88d2b56160c
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-