General
-
Target
450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6
-
Size
4.1MB
-
Sample
220625-e85w3agfd4
-
MD5
a0c00db1c96524b17161060ecbbe6a87
-
SHA1
3eaa22467cf0f6a741d5e262c4b416db8c0a1f4b
-
SHA256
450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6
-
SHA512
cedd14061d0d4c1035448d386f327478cfcf6bf3eb3c2c4589580e1e6ce30448f291658e50e44a5eb108caca515980e63525c008172951f7127111418374192a
Static task
static1
Behavioral task
behavioral1
Sample
450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6
-
Size
4.1MB
-
MD5
a0c00db1c96524b17161060ecbbe6a87
-
SHA1
3eaa22467cf0f6a741d5e262c4b416db8c0a1f4b
-
SHA256
450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6
-
SHA512
cedd14061d0d4c1035448d386f327478cfcf6bf3eb3c2c4589580e1e6ce30448f291658e50e44a5eb108caca515980e63525c008172951f7127111418374192a
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-