General
-
Target
3fe159fd4ddb3f8aed074018ad8539ecd04cfa03900d9cd8e04c16b3cccff391
-
Size
4.3MB
-
Sample
221127-mm74asaf44
-
MD5
e43f0cde1caa01ed8e835ad4b7c804a4
-
SHA1
c62edbe1005123d7161dd1b85a707a29e8f48ff3
-
SHA256
3fe159fd4ddb3f8aed074018ad8539ecd04cfa03900d9cd8e04c16b3cccff391
-
SHA512
31b279ff2b79b7b8faa1f464c3871838b5cac4d3469729699c74e7e6c909a7a833f2e76e84de7c100dc11c32747f46aea4d4acf7144b4d72479286bb2902f819
-
SSDEEP
98304:krZcQqVzLFHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKm:kWQmzLHdjjqPdDsDbsU0akJyxL405+fq
Behavioral task
behavioral1
Sample
3fe159fd4ddb3f8aed074018ad8539ecd04cfa03900d9cd8e04c16b3cccff391.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
3fe159fd4ddb3f8aed074018ad8539ecd04cfa03900d9cd8e04c16b3cccff391
-
Size
4.3MB
-
MD5
e43f0cde1caa01ed8e835ad4b7c804a4
-
SHA1
c62edbe1005123d7161dd1b85a707a29e8f48ff3
-
SHA256
3fe159fd4ddb3f8aed074018ad8539ecd04cfa03900d9cd8e04c16b3cccff391
-
SHA512
31b279ff2b79b7b8faa1f464c3871838b5cac4d3469729699c74e7e6c909a7a833f2e76e84de7c100dc11c32747f46aea4d4acf7144b4d72479286bb2902f819
-
SSDEEP
98304:krZcQqVzLFHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKm:kWQmzLHdjjqPdDsDbsU0akJyxL405+fq
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-