General
-
Target
5d36ba6502005e42710ed4fceb11d604.exe
-
Size
11.0MB
-
Sample
230312-pcltesfg9z
-
MD5
5d36ba6502005e42710ed4fceb11d604
-
SHA1
fa445ba179a4dc8d0c485f0fa6b0bee9b86960fd
-
SHA256
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43
-
SHA512
eb29507087f1463a52cca7b36d77c20e638475f508fb6703fed44b7417aa520cb38d7bc9506ba3730ad57c3fd32a50cfca9fb6d5c7026f76f2ef2d41fca63454
-
SSDEEP
196608:FvJA5AWU9xc7xLp8QacUG4raKu24YY7HVT4hV0AD6QgqKRgX:Fv459LWvmKr4YYH+EUWpgX
Behavioral task
behavioral1
Sample
5d36ba6502005e42710ed4fceb11d604.exe
Resource
win7-20230220-en
Malware Config
Extracted
bitrat
1.38
current-necessity.at.ply.gg:49446
-
communication_password
c5e4e64cc9384fda09aa232c1811af0e
-
install_dir
MsSystemDriver
-
install_file
MsMpEng
-
tor_process
tor
Targets
-
-
Target
5d36ba6502005e42710ed4fceb11d604.exe
-
Size
11.0MB
-
MD5
5d36ba6502005e42710ed4fceb11d604
-
SHA1
fa445ba179a4dc8d0c485f0fa6b0bee9b86960fd
-
SHA256
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43
-
SHA512
eb29507087f1463a52cca7b36d77c20e638475f508fb6703fed44b7417aa520cb38d7bc9506ba3730ad57c3fd32a50cfca9fb6d5c7026f76f2ef2d41fca63454
-
SSDEEP
196608:FvJA5AWU9xc7xLp8QacUG4raKu24YY7HVT4hV0AD6QgqKRgX:Fv459LWvmKr4YYH+EUWpgX
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-