General
-
Target
AnyDesk.exe
-
Size
5.5MB
-
Sample
230313-s3lswsba47
-
MD5
33614c059849aaeacaa68422b11a9795
-
SHA1
baf66bc7a279fcde9fa90708c153e06b89bb60d9
-
SHA256
25884495d9c27c8b120bfab40bd28b7f5255b4916c54c7fb74a90dd8000bf44e
-
SHA512
c211cfee30e6f3336a0d4aa8e44d91be4fb0399c2dc7d8a01b37d4264b44865c51037f5b6470f3aecd53cb551951132d80fbdba3b18fe0787cacd6166a66e5f6
-
SSDEEP
98304:cKYGKdACTgvV6qPvZpgvXM/N3qZBO0cY2YPGvhP0JGom5:cp86qPvZ6v6NH0l7PXm5
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
AnyDesk.exe
-
Size
5.5MB
-
MD5
33614c059849aaeacaa68422b11a9795
-
SHA1
baf66bc7a279fcde9fa90708c153e06b89bb60d9
-
SHA256
25884495d9c27c8b120bfab40bd28b7f5255b4916c54c7fb74a90dd8000bf44e
-
SHA512
c211cfee30e6f3336a0d4aa8e44d91be4fb0399c2dc7d8a01b37d4264b44865c51037f5b6470f3aecd53cb551951132d80fbdba3b18fe0787cacd6166a66e5f6
-
SSDEEP
98304:cKYGKdACTgvV6qPvZpgvXM/N3qZBO0cY2YPGvhP0JGom5:cp86qPvZ6v6NH0l7PXm5
Score10/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-