General
-
Target
Caiori.exe
-
Size
55.9MB
-
Sample
230315-qpf95sdc62
-
MD5
fa2506d2f26a8620252672f9b4fe1982
-
SHA1
c44d2903a80f22bb6956895f24c52e4e281d0e30
-
SHA256
09616435fdac3fc6dbc3ada7c6f3aed5a4a369418a99a162e8c6134d25a905ea
-
SHA512
b4a5245570156fb4bcbbcd162a6c7550d6ca04b4b6434c2d05e370462910f8c492e5058e96806f2f8a7fb8bdbf4f73e63459c61485e95f237a37a1942fe02c54
-
SSDEEP
786432:80LoCOn+27s4urYDNulLBiuV8P876Drt57RVK4Q/h5pUaHUL:8MoCm/7Xw6O4Q/h5pUL
Malware Config
Targets
-
-
Target
Caiori.exe
-
Size
55.9MB
-
MD5
fa2506d2f26a8620252672f9b4fe1982
-
SHA1
c44d2903a80f22bb6956895f24c52e4e281d0e30
-
SHA256
09616435fdac3fc6dbc3ada7c6f3aed5a4a369418a99a162e8c6134d25a905ea
-
SHA512
b4a5245570156fb4bcbbcd162a6c7550d6ca04b4b6434c2d05e370462910f8c492e5058e96806f2f8a7fb8bdbf4f73e63459c61485e95f237a37a1942fe02c54
-
SSDEEP
786432:80LoCOn+27s4urYDNulLBiuV8P876Drt57RVK4Q/h5pUaHUL:8MoCm/7Xw6O4Q/h5pUL
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-