General
-
Target
50DA248332E17121AF01CD7929069B7F.fil
-
Size
7.1MB
-
Sample
220727-vxgcbsbfd9
-
MD5
50da248332e17121af01cd7929069b7f
-
SHA1
0fe37d82a25b11f189fae1469352851a0e6f2a87
-
SHA256
6254f13144bdddb0931ad447830f9af5281cbb8f6b77c2a1357940762dbc4cc9
-
SHA512
af35df32c61cd0b3dfdd9ab378fbd12e3e57f28fd6759e7aaaec8f8409a30a66c963a386311b4dea47f050816008acb33f71fbcca275039523a7b938841e0812
Static task
static1
Behavioral task
behavioral1
Sample
50DA248332E17121AF01CD7929069B7F.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
50DA248332E17121AF01CD7929069B7F.fil
-
Size
7.1MB
-
MD5
50da248332e17121af01cd7929069b7f
-
SHA1
0fe37d82a25b11f189fae1469352851a0e6f2a87
-
SHA256
6254f13144bdddb0931ad447830f9af5281cbb8f6b77c2a1357940762dbc4cc9
-
SHA512
af35df32c61cd0b3dfdd9ab378fbd12e3e57f28fd6759e7aaaec8f8409a30a66c963a386311b4dea47f050816008acb33f71fbcca275039523a7b938841e0812
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-