General
-
Target
Setup_3.exe
-
Size
386.2MB
-
Sample
220727-x2eemsggbj
-
MD5
a8b08bd8aeed8e21b5980c2a8f68a73a
-
SHA1
284096cc1f85ec1c6bc96afde0b6a200124b2b19
-
SHA256
8646d12ad525262b59762afac1e66d2b145b88575ab6c2c3c82f0dd85fa99a83
-
SHA512
feb882a018d8364be6d26f69024f7279b7a72de80f1e9f76d9a20d67a04731d15aa1247ee43c9e4f4ef02c0af3253de6c00a76e025e8668cc09f88fa32eb4574
Behavioral task
behavioral1
Sample
Setup_3.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
Setup_3.exe
-
Size
386.2MB
-
MD5
a8b08bd8aeed8e21b5980c2a8f68a73a
-
SHA1
284096cc1f85ec1c6bc96afde0b6a200124b2b19
-
SHA256
8646d12ad525262b59762afac1e66d2b145b88575ab6c2c3c82f0dd85fa99a83
-
SHA512
feb882a018d8364be6d26f69024f7279b7a72de80f1e9f76d9a20d67a04731d15aa1247ee43c9e4f4ef02c0af3253de6c00a76e025e8668cc09f88fa32eb4574
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-