General
-
Target
Reserva_old.iso
-
Size
5.3MB
-
Sample
230321-k9md1ahe39
-
MD5
c035bc2f0a40b574e3da53a675bd6ffe
-
SHA1
94e491e9763dd2726dc83e063286361396803a7e
-
SHA256
3ab205427a802bbe0759e6af92696e88d453910480fd0e85d89431d2cefe30fa
-
SHA512
de95f8cdcccbecdb270df4509c2374f0cfdb0531866dba978f2c0ce0758eb1ed08d5f7152b198084ce3aabe16df600f46a241765d07702becbbc98e94351437f
-
SSDEEP
49152:zHSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGW:
Static task
static1
Behavioral task
behavioral1
Sample
INFORMAC.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
INFORMAC.vbs
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
INFORMAC.VBS
-
Size
4.7MB
-
MD5
7682d10c7d8f06b663b1d0f16067adf4
-
SHA1
408ba3988f038083f382b89a0fb0889a6ccf0658
-
SHA256
0d49ed0ef687b35e0f3a806dc9f20dd9cef84ea06a197319ee8c4a1b5a04aad4
-
SHA512
8119e6a7fb71fde2b2ebbcd143ad08ea3fb53b8a3cce767cf487d685ec88673ed20bbfad5b8449ab7370e9a5f7043ba060c42abb126bb51da28d416f335faead
-
SSDEEP
49152:3HSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGWP:m
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-