Resubmissions
21-08-2022 14:53
220821-r9e39aahej 820-08-2022 19:34
220820-yajeysada3 818-08-2022 19:56
220818-ynvp5seac3 814-08-2022 21:38
220814-1hgbnsddf5 818-07-2022 04:40
220718-fajfvaafdl 118-07-2022 04:26
220718-e2lvlsaegj 816-07-2022 04:29
220716-e4rtmsgeg3 816-07-2022 03:58
220716-ejzczsgde2 811-07-2022 19:19
220711-x1h2facabn 1010-07-2022 23:55
220710-3yffesdfan 10General
Static task
static1
URLScan task
urlscan1
Malware Config
Targets
-
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-