General
-
Target
AtXtpwIJyQWWufbN.exe
-
Size
14.2MB
-
Sample
240428-y7w3bagc94
-
MD5
00a57273989a40b1757b890c80c8a92a
-
SHA1
59a68061603d9e14e8f7b850329ea675ee417062
-
SHA256
7b9e81cf36ee3fb1224156663a138fc6a279a5ae61e53f59a413b3e825b9c1df
-
SHA512
d9a962e6ec98f76ad159d64f1e8351729565aa7445f4cc181bd13607ba57d2019dec5ff2f3d3d6b5f46299a14b714705eeeec5c6f1515e6ef3cc0d2946c6690b
-
SSDEEP
393216:WYJ5Qt9iFsm7tzozxGMJbGVGcZcT+FaJFAorO:WYwKFBCzgM0LAkSO
Static task
static1
Behavioral task
behavioral1
Sample
AtXtpwIJyQWWufbN.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
AtXtpwIJyQWWufbN.exe
-
Size
14.2MB
-
MD5
00a57273989a40b1757b890c80c8a92a
-
SHA1
59a68061603d9e14e8f7b850329ea675ee417062
-
SHA256
7b9e81cf36ee3fb1224156663a138fc6a279a5ae61e53f59a413b3e825b9c1df
-
SHA512
d9a962e6ec98f76ad159d64f1e8351729565aa7445f4cc181bd13607ba57d2019dec5ff2f3d3d6b5f46299a14b714705eeeec5c6f1515e6ef3cc0d2946c6690b
-
SSDEEP
393216:WYJ5Qt9iFsm7tzozxGMJbGVGcZcT+FaJFAorO:WYwKFBCzgM0LAkSO
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-