General
-
Target
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b.zip
-
Size
6.4MB
-
Sample
230321-qpxxwsae54
-
MD5
22dd25f4f8439f5b8b4667ca79b16383
-
SHA1
6a393081dc1f20bf803e8771f54c4b30412a6974
-
SHA256
4b022a164a4ff97f2f84bb37d827b05e727e834de36da85ea903337e7bcea898
-
SHA512
0d2403a27c19e8aa18846fb849aa59e8fc6657724b53f398b51b25e59ec395ce9bd546fcf21f2e5e45269b15fa725aa228e0b5c864d6ec87fd114877c4bcb3f4
-
SSDEEP
196608:SiU2+Kc8q9C8sI+mJQ/lGy+sXg0Xt7h2k:SiU2Zc8qo8sI+mJQlTdg8th
Static task
static1
Behavioral task
behavioral1
Sample
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b.exe
-
Size
6.7MB
-
MD5
da503ddb68a25aa665e0e15855ef4012
-
SHA1
0c016eb8eb016a1d0d36e1dc338e2766d40c7464
-
SHA256
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b
-
SHA512
eff07f20f8d9ba9b337220a4143d61eeabee58a3788f796563581e7ad5dcd6a297124987ebab8675752fd3f0a3cb14fbd29d7dc9ae568aa866ce3be8734fbc47
-
SSDEEP
98304:fPTCG6TDhi5vXL1tnX5Iz3OIyN5RRZc2B9iv/BE645Z5rhnqrKUIqf5pQNVPoPY:f7CG6TQZLzkeIcRZvBQvq6erFQKqLQ3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-