General
-
Target
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6
-
Size
1.6MB
-
Sample
220415-fh2x6aeefn
-
MD5
e61584555e51380572f761c8d05b44e7
-
SHA1
48cd82d6aafc9413915315f495079eaea8701a7f
-
SHA256
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6
-
SHA512
21dd91d23e7ae017427f8dbe6f13e435fcf330ea514d8551c796d9ad1178657d3f034a00a3b2e9362fa691db1753fc5ed1dc58b6772f23469c9a778f0e469349
Static task
static1
Behavioral task
behavioral1
Sample
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6
-
Size
1.6MB
-
MD5
e61584555e51380572f761c8d05b44e7
-
SHA1
48cd82d6aafc9413915315f495079eaea8701a7f
-
SHA256
f8478d278e0557a435b569a5cd8a853a910b81d1d5ca5a53e1acd4e341442fd6
-
SHA512
21dd91d23e7ae017427f8dbe6f13e435fcf330ea514d8551c796d9ad1178657d3f034a00a3b2e9362fa691db1753fc5ed1dc58b6772f23469c9a778f0e469349
Score10/10-
Panda Stealer Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-