General
-
Target
35b05a0938064d3be3acd398c6e07750e94eeea80449ee713a7fdc0442f59f06
-
Size
2.4MB
-
Sample
220708-r3qamsecfp
-
MD5
8a5b6d081faf535311f38068373e2e3a
-
SHA1
e98d578d20a2c371a50fc5e59791539e045df035
-
SHA256
35b05a0938064d3be3acd398c6e07750e94eeea80449ee713a7fdc0442f59f06
-
SHA512
b6fa8990153459f8549670e7e1d7d520a296a704dca909dc64a359da3958fcd460dce7a0b0ddd80aa0dab9e4c23a9aa0e5dcbc40790ac801b71b686ab0b2a7b1
Static task
static1
Behavioral task
behavioral1
Sample
35b05a0938064d3be3acd398c6e07750e94eeea80449ee713a7fdc0442f59f06.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
35b05a0938064d3be3acd398c6e07750e94eeea80449ee713a7fdc0442f59f06
-
Size
2.4MB
-
MD5
8a5b6d081faf535311f38068373e2e3a
-
SHA1
e98d578d20a2c371a50fc5e59791539e045df035
-
SHA256
35b05a0938064d3be3acd398c6e07750e94eeea80449ee713a7fdc0442f59f06
-
SHA512
b6fa8990153459f8549670e7e1d7d520a296a704dca909dc64a359da3958fcd460dce7a0b0ddd80aa0dab9e4c23a9aa0e5dcbc40790ac801b71b686ab0b2a7b1
-
Taurus Stealer payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-