General
-
Target
98210e2d9b34c77ecf43909546294cc4.bin
-
Size
685KB
-
Sample
230317-jkpx6aha2w
-
MD5
1f5c304b3444024dc96efebb682300e6
-
SHA1
4b54106b83913f6d3852c65cdf639e2f775360b7
-
SHA256
3a585a8cf432715f635ddf4851be290a25719c224c1d3c32ae5ccc926b6a809e
-
SHA512
138c8b38469254d9ae2a3c2e705cb0f93f77e21ef85326a638a714f82a5b8fc627660d1f3f98777a5a4ec4dd9ab734f85cbdb1cf446fdc4cef09bb2e5210c91f
-
SSDEEP
12288:C+qEVe7bIuqzfR44Mgo1UcPq0Pw8p/Jwty2ALgq50HF+Cz5WGkKMfj8:C+qEVeAPazgoRq+w8p/J8q50l+CXjMfA
Static task
static1
Behavioral task
behavioral1
Sample
7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5d.exe
Resource
win7-20230220-en
Malware Config
Extracted
cryptbot
http://erniku42.top/gate.php
-
payload_url
http://ovapfa05.top/unfele
Targets
-
-
Target
7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5d.exe
-
Size
791KB
-
MD5
98210e2d9b34c77ecf43909546294cc4
-
SHA1
2882ee363adc9fce181b202459897f0f82987807
-
SHA256
7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5d
-
SHA512
b72772bfbb6c541e9263fd7008447084b4da58c0c4ffe7a4ea50ab029ab74f294388e51267f9d8136c54c099a5d369718e5bba98809acd506068bf512da39d4b
-
SSDEEP
24576:wosWSM18jjQ34deYJRQw6fVHsxIeMrjXqCC6xMjvFCPH43H:LsWSMy/QIzQwsVHsxIeMqCCEMjyM
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-