General
-
Target
Arxvestiys MW2 Chair.exe
-
Size
5.3MB
-
Sample
230318-xs4ceadd84
-
MD5
a1f52e29a90caeec1d5f17221cc00270
-
SHA1
899cc3badca0c1ee1f66e8d316515a43da24e293
-
SHA256
d6b2bef46ec5456b8c44f0e5cee4fb410605478f72256c0c6b9f06d1cf74135b
-
SHA512
637685116a361a03adc9b1303124040038c33f2f06afac7fad9c89158d94a92492e00582a5e8d88d819c787ecc3d606c3911635bd805e742000f1780c40edca5
-
SSDEEP
98304:TJBa9sRM5F3JDq5lokIMgLipppaEVjlzHuxOoOUKko1O7A+ED/g5pivHnypy2SBm:TJE9c83Sl6xmt5HgOoOUK91CPPriPy4Y
Behavioral task
behavioral1
Sample
Arxvestiys MW2 Chair.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
Arxvestiys MW2 Chair.exe
-
Size
5.3MB
-
MD5
a1f52e29a90caeec1d5f17221cc00270
-
SHA1
899cc3badca0c1ee1f66e8d316515a43da24e293
-
SHA256
d6b2bef46ec5456b8c44f0e5cee4fb410605478f72256c0c6b9f06d1cf74135b
-
SHA512
637685116a361a03adc9b1303124040038c33f2f06afac7fad9c89158d94a92492e00582a5e8d88d819c787ecc3d606c3911635bd805e742000f1780c40edca5
-
SSDEEP
98304:TJBa9sRM5F3JDq5lokIMgLipppaEVjlzHuxOoOUKko1O7A+ED/g5pivHnypy2SBm:TJE9c83Sl6xmt5HgOoOUK91CPPriPy4Y
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-