General
-
Target
22ec2adbd53e81bd8f3a189b5c475ee7078ebe8f79af2771dd4a2d3cfc3fae9f
-
Size
2.6MB
-
Sample
220215-scmx9shdgl
-
MD5
9c8142047df3966d72ee64a59b467a29
-
SHA1
ad46a75ae11827c7776a41662abb7d0ba0d6e33a
-
SHA256
22ec2adbd53e81bd8f3a189b5c475ee7078ebe8f79af2771dd4a2d3cfc3fae9f
-
SHA512
4761aa85d4afec93f3b829fb9060d9f8af501674398c5764bcaf7bace8a35bef49028d326cbff956127c1600964cfb9a59b19973ca0bad0bcb91833b9bb33bc0
Static task
static1
Behavioral task
behavioral1
Sample
22ec2adbd53e81bd8f3a189b5c475ee7078ebe8f79af2771dd4a2d3cfc3fae9f.exe
Resource
win7-en-20211208
Malware Config
Targets
-
-
Target
22ec2adbd53e81bd8f3a189b5c475ee7078ebe8f79af2771dd4a2d3cfc3fae9f
-
Size
2.6MB
-
MD5
9c8142047df3966d72ee64a59b467a29
-
SHA1
ad46a75ae11827c7776a41662abb7d0ba0d6e33a
-
SHA256
22ec2adbd53e81bd8f3a189b5c475ee7078ebe8f79af2771dd4a2d3cfc3fae9f
-
SHA512
4761aa85d4afec93f3b829fb9060d9f8af501674398c5764bcaf7bace8a35bef49028d326cbff956127c1600964cfb9a59b19973ca0bad0bcb91833b9bb33bc0
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-