General
-
Target
Ip_scanner.exe
-
Size
5.1MB
-
Sample
220819-k2qrfsdhh9
-
MD5
58c40d0ad81f25bcd68a5523d867eb34
-
SHA1
4066f9bdb046b6feaf612bc7571f8b0f3a1ca169
-
SHA256
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367
-
SHA512
e43c16f3df411c5bd26a4491be86071c135facfce42a8b48608224060216c6b5552bf7d2fd25eccecd4fea27ad3d2e1e1c7ea03a8999430056ca8a33e29399dd
-
SSDEEP
98304:B5Sn52sYtLDfSR654zrPp8/Rq3ZEVkERxCFJiT0Gu4ueeZT:w4sxR65OpsEZEVjvMJiAMutT
Behavioral task
behavioral1
Sample
Ip_scanner.exe
Resource
win7-20220812-en
Malware Config
Extracted
vidar
53.4
1364
https://t.me/cheaptrains
https://mastodon.social/@ffolegg94
-
profile_id
1364
Targets
-
-
Target
Ip_scanner.exe
-
Size
5.1MB
-
MD5
58c40d0ad81f25bcd68a5523d867eb34
-
SHA1
4066f9bdb046b6feaf612bc7571f8b0f3a1ca169
-
SHA256
1f4c5ab072f384b9adfafd35903c5b54b8a3ad167250728d0d400454300a4367
-
SHA512
e43c16f3df411c5bd26a4491be86071c135facfce42a8b48608224060216c6b5552bf7d2fd25eccecd4fea27ad3d2e1e1c7ea03a8999430056ca8a33e29399dd
-
SSDEEP
98304:B5Sn52sYtLDfSR654zrPp8/Rq3ZEVkERxCFJiT0Gu4ueeZT:w4sxR65OpsEZEVjvMJiAMutT
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-