General
-
Target
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.zip
-
Size
6.4MB
-
Sample
230321-qpv4asce7y
-
MD5
628b9911104c7b7d727f7ac3a1a9bda8
-
SHA1
aeea1617cba5854e35f1ac1a9ef843ceb2a30592
-
SHA256
55559044bb010cf45383e3f392a6b32afffa623e677ad3b762bb2ca10062df0b
-
SHA512
dd14e06150c77e86af407104824e013cb884213fa28d0bcf296b539ece6c1b8bf8d8c914dbb1b00e7dd471e48e4dcb69b02c0e8cdbbfbb4ed52eda709345656b
-
SSDEEP
196608:LlQJCj827PDZT3dpVafeUTQOOtDB4XP4TW:LZjzrZTHVWeaQxDyiW
Static task
static1
Behavioral task
behavioral1
Sample
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe
-
Size
6.8MB
-
MD5
ca6b1b3b00d1bdccb7cc73255bc97329
-
SHA1
88923d5bf5f29cab5fe3ac66459bc94d709b06a1
-
SHA256
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1
-
SHA512
fd92162cb9fc5f0a22e25b17cf9386034121af061b821531823292778978f7f44c2e51a7eadc07e902560ec8cffd389a40dd32649ffe3782fbf956dc293224b3
-
SSDEEP
196608:V09b1yxhIsD1xLyVUZIBZjUQHQ8dq9XvjUQ:V09bsBvy2GjeV
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-