General
-
Target
Setup-Crack-Key.exe
-
Size
394.8MB
-
Sample
220727-ryv1bsegcm
-
MD5
16a270e38302409f5e21ff3199d4e072
-
SHA1
eb55332d66c1183139f442c44a2a650bc6ee62b5
-
SHA256
d469d7f395bc7c4c44d1340a299ccd03c39971587f09380fc433b5ea746a6137
-
SHA512
47063be4eda5123e7a7f4267d4f127cd9a461c12d74fb891b42578dca47fd02ddbe08047865b79c5317b4317a045346f4bfe92131402395af9766b27ca6b4305
Behavioral task
behavioral1
Sample
Setup-Crack-Key.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
Setup-Crack-Key.exe
-
Size
394.8MB
-
MD5
16a270e38302409f5e21ff3199d4e072
-
SHA1
eb55332d66c1183139f442c44a2a650bc6ee62b5
-
SHA256
d469d7f395bc7c4c44d1340a299ccd03c39971587f09380fc433b5ea746a6137
-
SHA512
47063be4eda5123e7a7f4267d4f127cd9a461c12d74fb891b42578dca47fd02ddbe08047865b79c5317b4317a045346f4bfe92131402395af9766b27ca6b4305
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-