General
-
Target
6bf0ff51fe6cedbce063dd18ee29f97f80cdd03e8ad38730def13979576b802b
-
Size
2.6MB
-
Sample
220625-ewpz3sgag5
-
MD5
c6bdbd8da4de7fc864b4e2c518eb85a2
-
SHA1
1a73470ab381256484393f4e0e6c6372ca2e0649
-
SHA256
6bf0ff51fe6cedbce063dd18ee29f97f80cdd03e8ad38730def13979576b802b
-
SHA512
afe57691b96051c3133ce68910d855684296af7976895d791978a0d75e32b0257134caa60f3dea60d38b4828db7070adb3ccaba8374183cbf7c8421dacdb6778
Static task
static1
Behavioral task
behavioral1
Sample
6bf0ff51fe6cedbce063dd18ee29f97f80cdd03e8ad38730def13979576b802b.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
6bf0ff51fe6cedbce063dd18ee29f97f80cdd03e8ad38730def13979576b802b
-
Size
2.6MB
-
MD5
c6bdbd8da4de7fc864b4e2c518eb85a2
-
SHA1
1a73470ab381256484393f4e0e6c6372ca2e0649
-
SHA256
6bf0ff51fe6cedbce063dd18ee29f97f80cdd03e8ad38730def13979576b802b
-
SHA512
afe57691b96051c3133ce68910d855684296af7976895d791978a0d75e32b0257134caa60f3dea60d38b4828db7070adb3ccaba8374183cbf7c8421dacdb6778
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-