Resubmissions
06/09/2026, 19:44
260906-yfzzwsfp6x105/08/2026, 21:14
260805-z3ah7a11aw12/04/2026, 08:20
260412-j8r3esfz5j127/03/2026, 07:27
260327-jafazagv6w06/07/2025, 13:50
250706-q5e21syta123/01/2024, 03:06
240123-dltd3sfcbm923/01/2024, 03:02
240123-djgx9sfhd91Analysis
- max time kernel
196s - max time network
202s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
- submitted
23/01/2024, 03:06
General
- Target iFRPFILE AIO v2.8.6.zip
- Size 39.3MB
- Sample240123-dltd3sfcbm
- SHA256 767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\iFRPFILE AIO v2.8.6.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\iFRPFILE AIO v2.8.6.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\iFRPFILE AIO v2.8.6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevicepair.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevicepair.exe" pair2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
-
C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe"C:\Users\Admin\Documents\iFRPFILE AIO v2.8.6\ref\win-x64\idevice_id.exe" -l2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT.dll
AgileDotNetRT.dll
memory/776-31-0x00007FFD85D4B000-0x00007FFD85D4F000-memory.dmp
memory/4460-22-0x0000000008740000-0x000000000880A000-memory.dmp
memory/4460-24-0x0000000008BC0000-0x0000000008C6A000-memory.dmp
memory/4460-2-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/4460-11-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-12-0x0000000077294000-0x0000000077295000-memory.dmp
memory/4460-14-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-15-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-18-0x0000000071ED0000-0x0000000071F50000-memory.dmp
memory/4460-19-0x0000000008250000-0x000000000859A000-memory.dmp
memory/4460-20-0x00000000085A0000-0x00000000085FC000-memory.dmp
memory/4460-21-0x00000000086A0000-0x0000000008732000-memory.dmp
memory/4460-0-0x0000000073460000-0x0000000073B4E000-memory.dmp
memory/4460-23-0x0000000008820000-0x000000000882A000-memory.dmp
memory/4460-3-0x0000000006130000-0x000000000662E000-memory.dmp
memory/4460-25-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/4460-26-0x000000000AD20000-0x000000000B070000-memory.dmp
memory/4460-27-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-28-0x0000000073460000-0x0000000073B4E000-memory.dmp
memory/4460-29-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-30-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/4460-1-0x0000000000790000-0x0000000001210000-memory.dmp
memory/4460-32-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/4460-33-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-34-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-36-0x0000000070D00000-0x0000000071485000-memory.dmp
memory/4460-37-0x0000000073460000-0x0000000073B4E000-memory.dmp