Overview

overview

9

Static

static

1

NEAS.7866c...40.exe

windows7-x64

9

NEAS.7866c...40.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.7866cd3f054d877ecf187047d5e4d340.exe

  • Size

    3.2MB

  • Sample

    231013-y9al4abb8t

  • MD5

    7866cd3f054d877ecf187047d5e4d340

  • SHA1

    1fbbe17f21389c03a50dda5d25caf62bae05da3a

  • SHA256

    82d3a386dbed3450612df8267523f204a823c6809401da6fe16441340573dda3

  • SHA512

    46a4673891ffbe8785722dbae44e4bdfe22526c78ecaccb5b1f9fed63331377b0da0ea1ea3d3533247a87e82ee333dbe8ce203a81af84fb137a129ece0a82878

  • SSDEEP

    98304:Lnob5A1YqdCPpnvOVrt8pppcqqRklqJSCTS3x:3VUPpnvOX8pbWeIhT2

Score
9/10
evasion

Malware Config

Targets

    • Target

      NEAS.7866cd3f054d877ecf187047d5e4d340.exe

    • Size

      3.2MB

    • MD5

      7866cd3f054d877ecf187047d5e4d340

    • SHA1

      1fbbe17f21389c03a50dda5d25caf62bae05da3a

    • SHA256

      82d3a386dbed3450612df8267523f204a823c6809401da6fe16441340573dda3

    • SHA512

      46a4673891ffbe8785722dbae44e4bdfe22526c78ecaccb5b1f9fed63331377b0da0ea1ea3d3533247a87e82ee333dbe8ce203a81af84fb137a129ece0a82878

    • SSDEEP

      98304:Lnob5A1YqdCPpnvOVrt8pppcqqRklqJSCTS3x:3VUPpnvOX8pbWeIhT2

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks