General
-
Target
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e
-
Size
7.1MB
-
Sample
220727-xh2e3agecm
-
MD5
df54c3125186517caab50a4ffef47798
-
SHA1
1044aab8a2dd1a5e3ae7af4bd612a5ac8eddd81a
-
SHA256
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e
-
SHA512
77cffdd55b502682304002df74b04df4c6cd18b050e0521351323f44e9fd7a6265be83d3a92abaf4d1f914632e9a17902378f0e894be6b0b06f52fcdb3054aa1
Behavioral task
behavioral1
Sample
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e.rar
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e.rar
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e
-
Size
7.1MB
-
MD5
df54c3125186517caab50a4ffef47798
-
SHA1
1044aab8a2dd1a5e3ae7af4bd612a5ac8eddd81a
-
SHA256
ec4c4a9fdafd66d72e7b9126954134d29133ac10757f85586d4f899954f5d49e
-
SHA512
77cffdd55b502682304002df74b04df4c6cd18b050e0521351323f44e9fd7a6265be83d3a92abaf4d1f914632e9a17902378f0e894be6b0b06f52fcdb3054aa1
Score3/10 -
-
-
Target
Setup/Setup.exe
-
Size
385.8MB
-
MD5
60441d5f669f8dfeca7c50d5324debd8
-
SHA1
d5a950aa64edf95e3cce3c4028636bf8ba6f0d81
-
SHA256
0d7844a741c16e35df0194c05f30e0e74607319f3b52b630bacfff3e1aac2d3a
-
SHA512
e67004cb71dbbe8398c3bcb65ea9150ccd150795f1a4ce2114b9685b3e10c4806da20c69b8c846393f28a436947fa665ad36f52e83ca32649b0dc6506f58592e
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-