General
-
Target
YS_External_V2.exe
-
Size
23.5MB
-
Sample
230326-kr7l8aga29
-
MD5
49bd07fcd35833d498db74a30e8da0c4
-
SHA1
695998aa01dcb54bbb8f3432d3eca4e39e84ee9b
-
SHA256
863ef4a6cc53d9ba762c43b053c60ff854ed5bb2a635d49ffa166569e8a8996c
-
SHA512
752ef105d0cc9196278f6fc9dbe40c6a940ae5543fc03962cfaa45c6e0e7183c6cfb7950d823131b01e6928214b408602bf888fcac531c7f8ed99ebeb07a21fa
-
SSDEEP
393216:nsL9KDKh8hHNQu6UDB5w0Lp/juLBqyBRhfvSOMQ0569yjRZ:nsLMDxy5cgqxjuwyBjAjo9k
Behavioral task
behavioral1
Sample
YS_External_V2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
YS_External_V2.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
YS_External_V2.exe
-
Size
23.5MB
-
MD5
49bd07fcd35833d498db74a30e8da0c4
-
SHA1
695998aa01dcb54bbb8f3432d3eca4e39e84ee9b
-
SHA256
863ef4a6cc53d9ba762c43b053c60ff854ed5bb2a635d49ffa166569e8a8996c
-
SHA512
752ef105d0cc9196278f6fc9dbe40c6a940ae5543fc03962cfaa45c6e0e7183c6cfb7950d823131b01e6928214b408602bf888fcac531c7f8ed99ebeb07a21fa
-
SSDEEP
393216:nsL9KDKh8hHNQu6UDB5w0Lp/juLBqyBRhfvSOMQ0569yjRZ:nsLMDxy5cgqxjuwyBjAjo9k
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-