General
-
Target
wow.zip
-
Size
972KB
-
Sample
240523-yldnvaea7y
-
MD5
f239e87b9e9c0528d3da6cd9cc97070e
-
SHA1
34ea694decfa1c940d622e5a6d35639a5fca13ad
-
SHA256
9f79190d363143b27efacf27d67a35f4f8ea781df79cdfa15fb1bde1a67641ca
-
SHA512
208435b399cc98ace42692211f6db3a6449103fe24c479b24c9516ad58e4767d7508214231ee49930f0327361f29e3d55b12841a15a7e8bdd10085f161047c9b
-
SSDEEP
24576:WBX4kPfUKOTlOHsSPbuBKJ5YqYXmWVIoNNU5ymDi:WBoe8ksSSKJKqcmQIoNWymO
Static task
static1
Behavioral task
behavioral1
Sample
Todoist-win32-9.3.2.exe
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
Todoist-win32-9.3.2.exe
-
Size
2.8MB
-
MD5
6756a24daf9628e691994def1e2ab195
-
SHA1
961a6658d2e6ddb0ba6cb2a489bcb692c93d4f85
-
SHA256
763f0e6d7e6700217888a98ef01e2e085ed81226e565b8b738ee4a2b48e9bdf1
-
SHA512
2683d573bcb29aa85e8c9f94df1a05901e234862f998d1db3f0ac40c1c97d465900cf9fb9f4272792b6319c4f6b516494b4fd8ac54671de560dd4b8eab3507dc
-
SSDEEP
24576:br4DpEFVbZL+N+coB8SBrCqJ6lPhgHxoeovCiaIhGGPThuaIvufnXfmeT3:n4DpwVbZL+ZoqSf6lPCoeovGGPw985T3
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-