General
-
Target
MHFNV-AnyDesk.zip
-
Size
7.1MB
-
Sample
230313-ssrw6ada5t
-
MD5
d823fc4cb1ca69045f306ba76720cc25
-
SHA1
e66efcc2ff0a5b729155adac25d36646497694b7
-
SHA256
fbcc321f10e8ed9fbda3e9d9ce6cc03ad1fa3c83578a2b22ec7f6fd853412750
-
SHA512
37ec7433645bfd88260ccb332a73dea6aedd0f1465bca322e4a90fede46468213186a227437ce075142e809d2b40d01267a546af5f2623ad185f3ca31f546f0c
-
SSDEEP
196608:IVvQZhCFrn0TKXb6Rxn9M8KMyc4k2cvBQxOKP+bX:XSrnCeY9Mdcz2ABQQKGbX
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
AnyDesk.exe
-
Size
5.5MB
-
MD5
33614c059849aaeacaa68422b11a9795
-
SHA1
baf66bc7a279fcde9fa90708c153e06b89bb60d9
-
SHA256
25884495d9c27c8b120bfab40bd28b7f5255b4916c54c7fb74a90dd8000bf44e
-
SHA512
c211cfee30e6f3336a0d4aa8e44d91be4fb0399c2dc7d8a01b37d4264b44865c51037f5b6470f3aecd53cb551951132d80fbdba3b18fe0787cacd6166a66e5f6
-
SSDEEP
98304:cKYGKdACTgvV6qPvZpgvXM/N3qZBO0cY2YPGvhP0JGom5:cp86qPvZ6v6NH0l7PXm5
Score10/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-