Identifies Wine through registry keys

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Windows security modification

Adds Run key to start application

Blocklisted process makes network request

Checks for any installed AV software in registry

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Legitimate hosting services abused for malware hosting/C2

Sets file execution options in registry

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.

Drops file in System32 directory

Modifies WinLogon for persistence

Suspicious use of SetThreadContext