General
-
Target
DCRatBuild_protected.bin
-
Size
4.7MB
-
Sample
220619-znp1bseee4
-
MD5
6772932f853a6bcaeaa4abf88286efdc
-
SHA1
d1e459274d36e8b6b72e9043bf1805a47ee85366
-
SHA256
ebbf1ac8a343ac2124263a44c9f9bba5f00d147521bded66e7f58b3bffa0051a
-
SHA512
eb1752bc5b9dd35bc35ca422042e519edf77cc89c305eee37bc8681dceaa8f6c9376288a439eec8ee469122fe2b0216263160dcdf11319c0efb9fef454ccc8e4
Static task
static1
Behavioral task
behavioral1
Sample
DCRatBuild_protected.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
DCRatBuild_protected.bin
-
Size
4.7MB
-
MD5
6772932f853a6bcaeaa4abf88286efdc
-
SHA1
d1e459274d36e8b6b72e9043bf1805a47ee85366
-
SHA256
ebbf1ac8a343ac2124263a44c9f9bba5f00d147521bded66e7f58b3bffa0051a
-
SHA512
eb1752bc5b9dd35bc35ca422042e519edf77cc89c305eee37bc8681dceaa8f6c9376288a439eec8ee469122fe2b0216263160dcdf11319c0efb9fef454ccc8e4
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-