General
-
Target
5e62ce2c758268030b2e673252c7c199.bin
-
Size
5.9MB
-
Sample
230321-bp1w8agb92
-
MD5
b7324284a79cc2f0986a38f678556d10
-
SHA1
c4edf77a6e7717c79a00bd898c73b695710ffe11
-
SHA256
7338871bcede33699c02119e58f47b0188f2b21780af64b30b3dffb19d12338d
-
SHA512
bd3aa5fd59c25681c4ecff368ffb8d83781bd092e1dcc7e1c8dcd973101b6bce7b11afb51ae498ab072c10ac1103384a54729d8a7febe2c8231e7aa328edfe29
-
SSDEEP
98304:o6NwxxBHhugaBX7lBMafQrMZpGe4X6tR3UtWaL8inzUzfRh0HVfQvzlMf+7T1WG1:PtFLlBM3IiytBU868inWQCvz7VWgGB7I
Static task
static1
Behavioral task
behavioral1
Sample
e39e047850594b792efd9c8ad328c9c32e15c77e9b4576d1c664703c7dcc8fdc.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
e39e047850594b792efd9c8ad328c9c32e15c77e9b4576d1c664703c7dcc8fdc.exe
-
Size
6.3MB
-
MD5
5e62ce2c758268030b2e673252c7c199
-
SHA1
80963e2c068c9b75bec6214e817435cbba17bbe0
-
SHA256
e39e047850594b792efd9c8ad328c9c32e15c77e9b4576d1c664703c7dcc8fdc
-
SHA512
93493a9e5f89f616eb3449bbb41c9027e3df69af6250f121ec993e22250265a5a774d4d8a6f9d08a06129278a0c16434c5d28a73d751f25af78e2d5c02459eaa
-
SSDEEP
98304:WI9ZCfZk3RIGgWhMIjVRr7SaB/JjNv+w3S+/KWpnMgcKrVuOtGTIDzO+kA6w2:WQoZ1zWhMIpBdJp+XGKinMg3u9MzeO2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-