General
-
Target
36ac3acd8c3eb0bb7d642d61ec4cc0e1a61eeae335c1c2d7e759d97233c60527
-
Size
394.7MB
-
Sample
230119-1b834sed7y
-
MD5
3b1cbceeeeb2afe955e3d9eb8aebfe2d
-
SHA1
a184bb6d82236bd928707fe1a54f8aa30af025c7
-
SHA256
36ac3acd8c3eb0bb7d642d61ec4cc0e1a61eeae335c1c2d7e759d97233c60527
-
SHA512
4c0ae900b351e92c16aee7fa6480c1850a03d6911926ce60eda1df9e292b5f556782e7eb2fabfc6bb63ac7f88223eb7b7e38487efb65e70b376899c848b71b47
-
SSDEEP
49152:WNEe0GkOi1F6eQ+ydT+jLdhYiGS29SVPNpLnZRVhYXj/2YROvymC0DLG:WNEezKfdBhs+PnVhYyYROvyym
Behavioral task
behavioral1
Sample
36ac3acd8c3eb0bb7d642d61ec4cc0e1a61eeae335c1c2d7e759d97233c60527.exe
Resource
win7-20220901-en
Malware Config
Extracted
raccoon
r. </comments> </property> <property name="ViewChunkyPixels" type="bool" default="true" label="Chunky pixels"> <comments> Chunky pixels mode when zoomed more than 100%. </comments> </property> </effect> <?xml version="1.0" encoding="utf-8"?> <effectgraph> <effect id="View.ZoomEffect" clsid="Microsoft.Imaging.Effects.TransformEffect"> <format software="8u" hardware="8u"/> </effect> <effect clsid="Microsoft.Imaging.Effects.CacheEffect"> <for
Extracted
raccoon
8eb14caca01131f5f4ff62ef8a0fcab4
http://45.89.54.95/
http://45.89.54.25/
Targets
-
-
Target
36ac3acd8c3eb0bb7d642d61ec4cc0e1a61eeae335c1c2d7e759d97233c60527
-
Size
394.7MB
-
MD5
3b1cbceeeeb2afe955e3d9eb8aebfe2d
-
SHA1
a184bb6d82236bd928707fe1a54f8aa30af025c7
-
SHA256
36ac3acd8c3eb0bb7d642d61ec4cc0e1a61eeae335c1c2d7e759d97233c60527
-
SHA512
4c0ae900b351e92c16aee7fa6480c1850a03d6911926ce60eda1df9e292b5f556782e7eb2fabfc6bb63ac7f88223eb7b7e38487efb65e70b376899c848b71b47
-
SSDEEP
49152:WNEe0GkOi1F6eQ+ydT+jLdhYiGS29SVPNpLnZRVhYXj/2YROvymC0DLG:WNEezKfdBhs+PnVhYyYROvyym
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-