General
-
Target
ca6b1b3b00d1bdccb7cc73255bc97329.bin
-
Size
6.4MB
-
Sample
230322-cc56vaec69
-
MD5
e100aeeb5e9338496b1c6b3b6a45f33c
-
SHA1
44638b3a3f4eeec8c4fb7757991e05b30e611131
-
SHA256
3ca0782c60feb696bc5237bdfa90d09afdd406e767b16f21c9159491d5376d20
-
SHA512
ba7b46d2b01e10fdaa094fd757fbdf87080cb0badab4be52c5b93e16f971675787a14e7672ae75762c2fa5c3639c9551f8bf22d13283b5f3ae1ddb9de90f2238
-
SSDEEP
196608:9jLW9DSlqL+tuiUlYpKLdcTbMWWGTuBkVUc:ep8uBYpKgbMWV1Kc
Static task
static1
Behavioral task
behavioral1
Sample
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1.exe
-
Size
6.8MB
-
MD5
ca6b1b3b00d1bdccb7cc73255bc97329
-
SHA1
88923d5bf5f29cab5fe3ac66459bc94d709b06a1
-
SHA256
23e3550cb43e9362251d56005e3c961c426d8e065ff2f2123f457e217415f6c1
-
SHA512
fd92162cb9fc5f0a22e25b17cf9386034121af061b821531823292778978f7f44c2e51a7eadc07e902560ec8cffd389a40dd32649ffe3782fbf956dc293224b3
-
SSDEEP
196608:V09b1yxhIsD1xLyVUZIBZjUQHQ8dq9XvjUQ:V09bsBvy2GjeV
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-