General
-
Target
AviraPhantomVPN.exe
-
Size
28.6MB
-
Sample
230406-prr9raeh5z
-
MD5
9466d6ac58ac215fb36794ce3f06a4e7
-
SHA1
d1ced42f619c5b4cc60951bd25287154974d3bff
-
SHA256
21558bfc700970d50d5bd91e9908582e17660279c2250e16fd45aef1f68ea6e9
-
SHA512
c7f1a0abf62359083bee4b33dcc8add0b4c5d55f240b0fa383e24c2f9992d40c8012d1ea71bb3b49a5bc0d67fe447361cf91d3d1bff7c564d6a7d36aea5606a2
-
SSDEEP
786432:zVVBHkKlbCkSxZhF9fplSYL7CuNS43ZfFI:zzB5lOj9LplbG6JFI
Static task
static1
Behavioral task
behavioral1
Sample
AviraPhantomVPN.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
AviraPhantomVPN.exe
-
Size
28.6MB
-
MD5
9466d6ac58ac215fb36794ce3f06a4e7
-
SHA1
d1ced42f619c5b4cc60951bd25287154974d3bff
-
SHA256
21558bfc700970d50d5bd91e9908582e17660279c2250e16fd45aef1f68ea6e9
-
SHA512
c7f1a0abf62359083bee4b33dcc8add0b4c5d55f240b0fa383e24c2f9992d40c8012d1ea71bb3b49a5bc0d67fe447361cf91d3d1bff7c564d6a7d36aea5606a2
-
SSDEEP
786432:zVVBHkKlbCkSxZhF9fplSYL7CuNS43ZfFI:zzB5lOj9LplbG6JFI
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-