General
-
Target
d7782e08a3b44b4ef4610f7833c96b1df8f67de10cf2cb09d55b7685751a898f
-
Size
2.1MB
-
Sample
220701-dpsxqabdg3
-
MD5
71d88d948dbbdef44e4cdc018dbfdfaa
-
SHA1
66d413da43d8328b37251bda200e57f93287f9f8
-
SHA256
d7782e08a3b44b4ef4610f7833c96b1df8f67de10cf2cb09d55b7685751a898f
-
SHA512
0ae41e50b8f45504b57967295e1637d08570203286f59b86ff6ea54686dc5ec50765a5005b0bd35701e6a3ab8cf836582aef7f74868232161509983de84f1419
Malware Config
Targets
-
-
Target
d7782e08a3b44b4ef4610f7833c96b1df8f67de10cf2cb09d55b7685751a898f
-
Size
2.1MB
-
MD5
71d88d948dbbdef44e4cdc018dbfdfaa
-
SHA1
66d413da43d8328b37251bda200e57f93287f9f8
-
SHA256
d7782e08a3b44b4ef4610f7833c96b1df8f67de10cf2cb09d55b7685751a898f
-
SHA512
0ae41e50b8f45504b57967295e1637d08570203286f59b86ff6ea54686dc5ec50765a5005b0bd35701e6a3ab8cf836582aef7f74868232161509983de84f1419
Score10/10-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-