General
-
Target
da503ddb68a25aa665e0e15855ef4012.bin
-
Size
6.4MB
-
Sample
230323-b9f3jscg85
-
MD5
f551d1d725f5a4b5c2cc752fa41318e7
-
SHA1
db291b3ba4374c3c8817723bdb336d4ee58b6417
-
SHA256
a697fb12870addba985b652b76b1f03ad8ed026a3401e78e6054912c198a2b07
-
SHA512
012789b50f13c55d02658cd03726db41f0c7cad4e173a349a4866685386a279da31fec39b6d70dd9b33ff3c6560a9670d06829b1f5585cab26616c4978c3c195
-
SSDEEP
98304:NuTalw+T8xWBeyJ86Re3sVZBByUsri3moyOGIZhaZbCej6aSR4dJR1BZS2pW80:NF186R6sVTUNi/ykY8ejARg7QV
Static task
static1
Behavioral task
behavioral1
Sample
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b.exe
-
Size
6.7MB
-
MD5
da503ddb68a25aa665e0e15855ef4012
-
SHA1
0c016eb8eb016a1d0d36e1dc338e2766d40c7464
-
SHA256
7d23a41da6b0a4c455aed086067e7eb764669ce4e567b9b11cb97588eccb903b
-
SHA512
eff07f20f8d9ba9b337220a4143d61eeabee58a3788f796563581e7ad5dcd6a297124987ebab8675752fd3f0a3cb14fbd29d7dc9ae568aa866ce3be8734fbc47
-
SSDEEP
98304:fPTCG6TDhi5vXL1tnX5Iz3OIyN5RRZc2B9iv/BE645Z5rhnqrKUIqf5pQNVPoPY:f7CG6TQZLzkeIcRZvBQvq6erFQKqLQ3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-