General
-
Target
.
-
Size
38KB
-
Sample
220801-qyegxaggd4
-
MD5
71b2262d19d20c85dc3f4ee21c9ae8a1
-
SHA1
f01876365490f3c8a087b8bfaf8ef2a7d8cf094a
-
SHA256
501a2e4da5036dcdcb5e029a29b974c7e7dd5626a8d0aab9daec57dbb0439067
-
SHA512
10b2883adee00e15f0ba561e6256b4d2ebc126977462682a11efbd0df53ff25e615faaca9e7f8601de93f61b90443f55b4a86386457b66106b9faaa4057126ec
Static task
static1
Malware Config
Targets
-
-
Target
.
-
Size
38KB
-
MD5
71b2262d19d20c85dc3f4ee21c9ae8a1
-
SHA1
f01876365490f3c8a087b8bfaf8ef2a7d8cf094a
-
SHA256
501a2e4da5036dcdcb5e029a29b974c7e7dd5626a8d0aab9daec57dbb0439067
-
SHA512
10b2883adee00e15f0ba561e6256b4d2ebc126977462682a11efbd0df53ff25e615faaca9e7f8601de93f61b90443f55b4a86386457b66106b9faaa4057126ec
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-