General
-
Target
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72
-
Size
5.2MB
-
Sample
221125-1mfwpsha64
-
MD5
49c379918af59eccf4ae0fa66a641582
-
SHA1
e8f91ee61a3704670fd174f296c4fa0c7e166533
-
SHA256
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72
-
SHA512
043606de8f7f160cafb58d742a7a45dc3b7b37eccc7581489ca1148aa1bbfab36229ed454d9f5a98544995ee03731ac62448b89db925ccdddae73ee82ae56298
-
SSDEEP
98304:ooBAkdr72GZAG/wK3EDOxmDITSKKjzxsFL/LfSMI5d2VWsN67GnYP3OKa:ooBAkh72GK4w+eOwDeSRfgb+KWsN6Cn7
Static task
static1
Behavioral task
behavioral1
Sample
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72
-
Size
5.2MB
-
MD5
49c379918af59eccf4ae0fa66a641582
-
SHA1
e8f91ee61a3704670fd174f296c4fa0c7e166533
-
SHA256
c4e3b5845fcb50f348a4bc74d01584a1d14654a23202fb9fa89738cc8e707e72
-
SHA512
043606de8f7f160cafb58d742a7a45dc3b7b37eccc7581489ca1148aa1bbfab36229ed454d9f5a98544995ee03731ac62448b89db925ccdddae73ee82ae56298
-
SSDEEP
98304:ooBAkdr72GZAG/wK3EDOxmDITSKKjzxsFL/LfSMI5d2VWsN67GnYP3OKa:ooBAkh72GK4w+eOwDeSRfgb+KWsN6Cn7
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-