General
-
Target
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd
-
Size
7.4MB
-
Sample
220727-xhwjtageck
-
MD5
c382d5e1cef468d4b1c10bf321629d13
-
SHA1
43a1088c1943c8172d994ec92aab0804479c6e0e
-
SHA256
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd
-
SHA512
6885924b018814a681836de49ba4d679e1f9f90e3b6536f3ef03e60c7796256e689bcc4ed081666ad4eb8719b65635ae2ae7a2172c24cc0e474a90d7909ecd7f
Behavioral task
behavioral1
Sample
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd.rar
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
Setup/Setup.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd
-
Size
7.4MB
-
MD5
c382d5e1cef468d4b1c10bf321629d13
-
SHA1
43a1088c1943c8172d994ec92aab0804479c6e0e
-
SHA256
a9939a8c340f63579b97c2cc8f676308bc7546ce3f1fe32c22bb9c54a2d7aecd
-
SHA512
6885924b018814a681836de49ba4d679e1f9f90e3b6536f3ef03e60c7796256e689bcc4ed081666ad4eb8719b65635ae2ae7a2172c24cc0e474a90d7909ecd7f
Score3/10 -
-
-
Target
Setup/Setup.exe
-
Size
386.2MB
-
MD5
a8b08bd8aeed8e21b5980c2a8f68a73a
-
SHA1
284096cc1f85ec1c6bc96afde0b6a200124b2b19
-
SHA256
8646d12ad525262b59762afac1e66d2b145b88575ab6c2c3c82f0dd85fa99a83
-
SHA512
feb882a018d8364be6d26f69024f7279b7a72de80f1e9f76d9a20d67a04731d15aa1247ee43c9e4f4ef02c0af3253de6c00a76e025e8668cc09f88fa32eb4574
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-