General
-
Target
d32cd492ab44503128b89ba0ae6778cb.exe
-
Size
7.5MB
-
Sample
230319-j15njshf7s
-
MD5
d32cd492ab44503128b89ba0ae6778cb
-
SHA1
78c4d59a96f7e025fa7ebe80030fd9bb4547d21a
-
SHA256
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c
-
SHA512
028b44c1eea7142e8f50d17d3de28030255689ff53cc4ef9dc505fb6feef649edbb1a59e8796ce84222e94d370b7ddc9d1aee3baff946e4862529d310641f64e
-
SSDEEP
196608:utjk/L5eZGBmm5t+fYOBaBMVrLWD+o88Vl:qxGBpIf9jVWD+o8sl
Static task
static1
Behavioral task
behavioral1
Sample
d32cd492ab44503128b89ba0ae6778cb.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
d32cd492ab44503128b89ba0ae6778cb.exe
-
Size
7.5MB
-
MD5
d32cd492ab44503128b89ba0ae6778cb
-
SHA1
78c4d59a96f7e025fa7ebe80030fd9bb4547d21a
-
SHA256
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c
-
SHA512
028b44c1eea7142e8f50d17d3de28030255689ff53cc4ef9dc505fb6feef649edbb1a59e8796ce84222e94d370b7ddc9d1aee3baff946e4862529d310641f64e
-
SSDEEP
196608:utjk/L5eZGBmm5t+fYOBaBMVrLWD+o88Vl:qxGBpIf9jVWD+o8sl
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-