General
-
Target
https://cdn.discordapp.com/attachments/1213895613779808328/1213928854133932094/tos_cracked.rar?ex=65f74258&is=65e4cd58&hm=fe7b192cfde2b0027ec544a1bb61c0a1e108dc216fd6b4609c3085c782476709&
-
Sample
240306-wf6rbsec73
Score
9/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1213895613779808328/1213928854133932094/tos_cracked.rar?ex=65f74258&is=65e4cd58&hm=fe7b192cfde2b0027ec544a1bb61c0a1e108dc216fd6b4609c3085c782476709&
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox drivers on disk
-
Looks for VMWare drivers on disk
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-