General
-
Target
def3bdf468ca1bc596de60ee7da7f37db673b89eb8cd9f9937b425cb6c61dfcf
-
Size
4.3MB
-
Sample
221127-mmgaksae94
-
MD5
91f915dc90d7abe26e5da69a0f4dd1ac
-
SHA1
180bb973faf4103338e7dd99108a37e8d57c0213
-
SHA256
def3bdf468ca1bc596de60ee7da7f37db673b89eb8cd9f9937b425cb6c61dfcf
-
SHA512
6e78b9c41b595a736c62c03b607524ae1a1b02ea5f2aa741fecc8a818eb34f1fe2fada100cdc9f240fa2c83ad7d8135d21924323b1f21bb014ad5be07a5b1c13
-
SSDEEP
98304:PopP6xYjTHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKP+:rOjhdjjqPdDsDbsU0akJyxL405+fiX
Behavioral task
behavioral1
Sample
def3bdf468ca1bc596de60ee7da7f37db673b89eb8cd9f9937b425cb6c61dfcf.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
def3bdf468ca1bc596de60ee7da7f37db673b89eb8cd9f9937b425cb6c61dfcf
-
Size
4.3MB
-
MD5
91f915dc90d7abe26e5da69a0f4dd1ac
-
SHA1
180bb973faf4103338e7dd99108a37e8d57c0213
-
SHA256
def3bdf468ca1bc596de60ee7da7f37db673b89eb8cd9f9937b425cb6c61dfcf
-
SHA512
6e78b9c41b595a736c62c03b607524ae1a1b02ea5f2aa741fecc8a818eb34f1fe2fada100cdc9f240fa2c83ad7d8135d21924323b1f21bb014ad5be07a5b1c13
-
SSDEEP
98304:PopP6xYjTHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKP+:rOjhdjjqPdDsDbsU0akJyxL405+fiX
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-