General
-
Target
Demonstrativo_de_Pendencias.zip
-
Size
8.8MB
-
Sample
220622-yqfc8sacgn
-
MD5
6ff7fd6d82436c481e3f5a7586ab720c
-
SHA1
394d345a3539c5589e128227e794513848dbdf87
-
SHA256
e215345053d1468b000078d1c0484a7752f228f61811b21c2b88142b2979ba74
-
SHA512
ad6bdc03700e18f81da843c762ef4b68fdc06d82907934b93d387b6246c5be774dbe45e336255a04a735916218c58a28addcccf0af2be665db99a91bf7f3e7bd
Static task
static1
Behavioral task
behavioral1
Sample
Aplicativo Seguro.msi
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Aplicativo Seguro.msi
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
Aplicativo Seguro.msi
-
Size
10.3MB
-
MD5
49c3e11795b5d0099ff2d33a5559471b
-
SHA1
d80f339bfaaf76794133be5e9364555636e6f68d
-
SHA256
7321a205de31cb4c93f10a090316502922d9083dfc076c93903377f36ada3aca
-
SHA512
515150687958abb273119a271dde066bbf491c884a22d744bc6564e1ef4b7266b695f4131c21f91352263a1a1111549da66304ad7f0d427f56fb100f94e56b88
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-