General
-
Target
Setup_13.exe
-
Size
371.6MB
-
Sample
220727-xygqlacea4
-
MD5
6dca4c6fbbc71f493212ee52a8de5de7
-
SHA1
9c0bcb01b9c892a36d93a667eb554652d0881a29
-
SHA256
85ba0f7790c50a07ef1cb227c452074fd3bfc7a3e94a6a7479bdb8470399086b
-
SHA512
ea82e353d81b79285c9898234821efe425529ad1d4b9afcb07cceaff63c836b6616ac7b3850627d2be1dcbb93e40b439fcb337eab1809c9a31befaead13b6cd8
Behavioral task
behavioral1
Sample
Setup_13.exe
Resource
win7-20220715-en
Malware Config
Targets
-
-
Target
Setup_13.exe
-
Size
371.6MB
-
MD5
6dca4c6fbbc71f493212ee52a8de5de7
-
SHA1
9c0bcb01b9c892a36d93a667eb554652d0881a29
-
SHA256
85ba0f7790c50a07ef1cb227c452074fd3bfc7a3e94a6a7479bdb8470399086b
-
SHA512
ea82e353d81b79285c9898234821efe425529ad1d4b9afcb07cceaff63c836b6616ac7b3850627d2be1dcbb93e40b439fcb337eab1809c9a31befaead13b6cd8
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-