General
-
Target
fg797p.exe
-
Size
7.1MB
-
Sample
220801-yl78fsgdh3
-
MD5
98042f03baf3cad4dc4ab8e882063e14
-
SHA1
87d47f67b8d4b021f19d1c1d8514453facca2be6
-
SHA256
da6ce92ec5c7305011dbfa5a6d4b81c43794eba55652744729744b4980e2b0c2
-
SHA512
7ddd8b95e58bf01f588f93d9864d90b65b4af7035b9f4c68dc93690c1a312193263a9a839ddeaead6f155548f3530569d0af3178d9b6c20c317b06f06e210377
Behavioral task
behavioral1
Sample
fg797p.exe
Resource
win7-20220718-en
Malware Config
Targets
-
-
Target
fg797p.exe
-
Size
7.1MB
-
MD5
98042f03baf3cad4dc4ab8e882063e14
-
SHA1
87d47f67b8d4b021f19d1c1d8514453facca2be6
-
SHA256
da6ce92ec5c7305011dbfa5a6d4b81c43794eba55652744729744b4980e2b0c2
-
SHA512
7ddd8b95e58bf01f588f93d9864d90b65b4af7035b9f4c68dc93690c1a312193263a9a839ddeaead6f155548f3530569d0af3178d9b6c20c317b06f06e210377
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-