Overview

overview

9

Static

static

7

c399a85eb4...57.exe

windows7-x64

9

c399a85eb4...57.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    c399a85eb4a58dda5ab2e16483be2357.bin
  • Size 5.2MB
  • Sample231211-dkv7aabchj
  • SHA256 c6f3d124c8679771ca65f0a03c5995da466eed2a2f707a7ea5b47aeadc5a1903
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionvmprotect

Malware Config

Targets

    • Target
      c399a85eb4a58dda5ab2e16483be2357.bin
    • Size 5.2MB
    • SHA256 c6f3d124c8679771ca65f0a03c5995da466eed2a2f707a7ea5b47aeadc5a1903
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasionvmprotect

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks