General
-
Target
7b898bb9d5b30e0dfc92479fb0b6143a128025ee28ed90218a2452dc30b6ebd9
-
Size
1.9MB
-
Sample
220725-fjnrxsffdn
-
MD5
3c76310629bf708ca48a498d881861c7
-
SHA1
f64bea924d6ebd14f498a73eb5cd19e2e943eab7
-
SHA256
7b898bb9d5b30e0dfc92479fb0b6143a128025ee28ed90218a2452dc30b6ebd9
-
SHA512
f07b581b1c44afad5c0124df187cfe3721adb351de74ab357b391afa42c8eee70e4d7604856da6fdde3bb7e8842545b4f26049748b7fa5ab4a511a2c46fa82b4
Malware Config
Targets
-
-
Target
7b898bb9d5b30e0dfc92479fb0b6143a128025ee28ed90218a2452dc30b6ebd9
-
Size
1.9MB
-
MD5
3c76310629bf708ca48a498d881861c7
-
SHA1
f64bea924d6ebd14f498a73eb5cd19e2e943eab7
-
SHA256
7b898bb9d5b30e0dfc92479fb0b6143a128025ee28ed90218a2452dc30b6ebd9
-
SHA512
f07b581b1c44afad5c0124df187cfe3721adb351de74ab357b391afa42c8eee70e4d7604856da6fdde3bb7e8842545b4f26049748b7fa5ab4a511a2c46fa82b4
Score10/10-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-