General
-
Target
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c.zip
-
Size
7.2MB
-
Sample
230321-rxraraba95
-
MD5
9c83b919476cfc3f6e9ed04b0bee98f2
-
SHA1
db650e0faf61e81121378a91a6f6f2aeae14cbf1
-
SHA256
91ea51ee5700fb722b5a2b0bc3f6ec628d47cbe91a134d809d65c5fb085ab4c7
-
SHA512
d3d1675426b45b868268f600ee88595a818fd2ddbb164855cc2e5365e97c174257b6715432afbb25238ec6cfd26029cdcbe33aa3933b66fabd49c67e5c72d6b3
-
SSDEEP
196608:2MAvxhwDLAR8pG6y3WhuzYDjipP5kGlekafKn9bx5J:VAv2eQo1zYePJIkaSbx5J
Static task
static1
Behavioral task
behavioral1
Sample
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c.exe
-
Size
7.5MB
-
MD5
d32cd492ab44503128b89ba0ae6778cb
-
SHA1
78c4d59a96f7e025fa7ebe80030fd9bb4547d21a
-
SHA256
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c
-
SHA512
028b44c1eea7142e8f50d17d3de28030255689ff53cc4ef9dc505fb6feef649edbb1a59e8796ce84222e94d370b7ddc9d1aee3baff946e4862529d310641f64e
-
SSDEEP
196608:utjk/L5eZGBmm5t+fYOBaBMVrLWD+o88Vl:qxGBpIf9jVWD+o8sl
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-