General
-
Target
adcf4f2d9028c52a8b7b7b7880aa5d6b.exe
-
Size
6.8MB
-
Sample
230321-xbrbhsee4y
-
MD5
adcf4f2d9028c52a8b7b7b7880aa5d6b
-
SHA1
60c9c134ff2cd2847b9f8ff58aead722e9ac43a8
-
SHA256
bdce60e92616f204631ebac6d57c74fd2214c9591c6faa2a76150c6ac15c6ac0
-
SHA512
2277f133303010cd19690d9142513bbd9cdd61c0189807cfe58ff7e2aa734623549992eb8e7bc8c306d6a292990904ce0a8a826f0c3e436a1d1d8f84ef5c6af4
-
SSDEEP
196608:0dvbLD+bI92rDvjxLZisgOb5nEqc93TkNboL:0vbLwrLjxLZishuT8A
Static task
static1
Behavioral task
behavioral1
Sample
adcf4f2d9028c52a8b7b7b7880aa5d6b.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
adcf4f2d9028c52a8b7b7b7880aa5d6b.exe
-
Size
6.8MB
-
MD5
adcf4f2d9028c52a8b7b7b7880aa5d6b
-
SHA1
60c9c134ff2cd2847b9f8ff58aead722e9ac43a8
-
SHA256
bdce60e92616f204631ebac6d57c74fd2214c9591c6faa2a76150c6ac15c6ac0
-
SHA512
2277f133303010cd19690d9142513bbd9cdd61c0189807cfe58ff7e2aa734623549992eb8e7bc8c306d6a292990904ce0a8a826f0c3e436a1d1d8f84ef5c6af4
-
SSDEEP
196608:0dvbLD+bI92rDvjxLZisgOb5nEqc93TkNboL:0vbLwrLjxLZishuT8A
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-