General
-
Target
d8e8f88c7028ae9a38cb9998eb1d8d93a62d7326e5c5f.exe
-
Size
5.7MB
-
Sample
220919-s7mkzsbbcq
-
MD5
bebd4982ccca9f7b4f9f40fe05ecdf65
-
SHA1
d9643b6b074f6bc9099b1a0b9ef583cd1876daf9
-
SHA256
d8e8f88c7028ae9a38cb9998eb1d8d93a62d7326e5c5f7eb141d8cb8b658213d
-
SHA512
eabe63849baf8d4ee46df03abfaf5f56ad4ec6d90b77c724d9281e4946b65db064d634bfa26346e46dab59bc3e176dfca2abc71d64b27e668f2438ee162d2240
-
SSDEEP
98304:Wh6xV6zRhld9E1BlYb9uto2jgrGeweoSYp2prwvLWaNFXvow17IugzlHbGSZBN7k:S2V8ld98BlON2jnbNswvBXvowJgzl7Gb
Behavioral task
behavioral1
Sample
d8e8f88c7028ae9a38cb9998eb1d8d93a62d7326e5c5f.exe
Resource
win7-20220901-en
Malware Config
Targets
-
-
Target
d8e8f88c7028ae9a38cb9998eb1d8d93a62d7326e5c5f.exe
-
Size
5.7MB
-
MD5
bebd4982ccca9f7b4f9f40fe05ecdf65
-
SHA1
d9643b6b074f6bc9099b1a0b9ef583cd1876daf9
-
SHA256
d8e8f88c7028ae9a38cb9998eb1d8d93a62d7326e5c5f7eb141d8cb8b658213d
-
SHA512
eabe63849baf8d4ee46df03abfaf5f56ad4ec6d90b77c724d9281e4946b65db064d634bfa26346e46dab59bc3e176dfca2abc71d64b27e668f2438ee162d2240
-
SSDEEP
98304:Wh6xV6zRhld9E1BlYb9uto2jgrGeweoSYp2prwvLWaNFXvow17IugzlHbGSZBN7k:S2V8ld98BlON2jnbNswvBXvowJgzl7Gb
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-