General
-
Target
Caiori.7z
-
Size
25.0MB
-
Sample
230315-r9a5asdg35
-
MD5
99536f2a3a94c1d6e9312a58a316dad5
-
SHA1
c9ba07fe92d6908a0c90d4fb02c6174b597668c6
-
SHA256
2f72a443711dcb2ed5a9f760fe517ee156963c7c73c8c77a29dbdb2469353254
-
SHA512
5db2b5776b1a62d00db6cd0d9f9300790165ed33c1e571d66fd8cf4f32d528f3f7647b569def0fa11f8d91ff4376e9e49e4e23043e4704ec3ac46129d535f452
-
SSDEEP
786432:XDkCEKNrQTlJnNgIIiJ8J1Ly9WcpxjLQ/7no6o+GJcdUrUF:XHjtaqfxJ1Nk6o6o+GJcdTF
Behavioral task
behavioral1
Sample
Caiori.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
Caiori.exe
-
Size
55.9MB
-
MD5
fa2506d2f26a8620252672f9b4fe1982
-
SHA1
c44d2903a80f22bb6956895f24c52e4e281d0e30
-
SHA256
09616435fdac3fc6dbc3ada7c6f3aed5a4a369418a99a162e8c6134d25a905ea
-
SHA512
b4a5245570156fb4bcbbcd162a6c7550d6ca04b4b6434c2d05e370462910f8c492e5058e96806f2f8a7fb8bdbf4f73e63459c61485e95f237a37a1942fe02c54
-
SSDEEP
786432:80LoCOn+27s4urYDNulLBiuV8P876Drt57RVK4Q/h5pUaHUL:8MoCm/7Xw6O4Q/h5pUL
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-