General
-
Target
08-stel.zip
-
Size
9.0MB
-
Sample
220809-j1j2vahbe8
-
MD5
fee0c52807639ddaabd63cd1bd373587
-
SHA1
6b6e437b51932d7640a2f574ff010c4a293f6bcd
-
SHA256
c4ed0c6c4546d7c623c7547eae8ff038756ab19347aae86b9ab1517566550efa
-
SHA512
a90adb88545d682087674a3fe046cf806fe6a8f4d60d3633bcdee50d84fc05112afc18fd8b7179cb894dd52220c3d0cfcd1692ba83c74bbd1162f6768bd9d66b
Behavioral task
behavioral1
Sample
iwcfbelmib.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
iwcfbelmib.dll
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
w0jzxs5v5026uywbjc1lll.exe
Resource
win7-20220718-en
Behavioral task
behavioral4
Sample
w0jzxs5v5026uywbjc1lll.exe
Resource
win10v2004-20220722-en
Malware Config
Targets
-
-
Target
iwcfbelmib.glf
-
Size
8.9MB
-
MD5
64407b3d50b351fb556850b5004ab591
-
SHA1
7ea3ed01bb26aaa7a90edd1c4fceea2de7ecebe1
-
SHA256
204f4aed39fc7625256f5f48812d8881c7f79b692bac0b0a484aba93205e061a
-
SHA512
25c0343283bb2097d135918c2eb61c8828575b4bef97a831577a321364ded073808c8588e391d681566974ef5ac192dd36ecaa4e05befddeb0b0e11833ef9e96
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
w0jzxs5v5026uywbjc1lll
-
Size
884KB
-
MD5
4685811c853ceaebc991c3a8406694bf
-
SHA1
9cd382eb91bfea5782dd09f589a31b47c2c2b53e
-
SHA256
3242e0a736ef8ac90430a9f272ff30a81e2afc146fcb84a25c6e56e8192791e4
-
SHA512
a504fbca674f15d8964ebc6fac11d9431d700ca22736c00d5bb1e51551b0d2b9e4b2b6824bdf1a778111a0ba8d2601eada2f726b9ec7a9cfa5a53fd43c235b46
Score1/10 -