General
-
Target
https://cdn.discordapp.com/attachments/1234979747243626567/1234981511166431263/goldgoldogldolgoldoglgoldfoldgoldogl.exe?ex=6632b5a9&is=66316429&hm=1254bec85e6ddd53b28e20364625491c6e1bd116d4714e90468133db34fd3071&
-
Sample
240501-aaqbhach97
Score
9/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1234979747243626567/1234981511166431263/goldgoldogldolgoldoglgoldfoldgoldogl.exe?ex=6632b5a9&is=66316429&hm=1254bec85e6ddd53b28e20364625491c6e1bd116d4714e90468133db34fd3071&
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-