Overview

overview

9

Static

static

3

cryptolaemus

windows10-2004-x64

9

cryptolaemus

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    de0f393bb2ba0f8da0300dcd6c7c0db03b915222eed80e287b00b4b0a3c85b58

  • Size

    2.3MB

  • Sample

    240620-vdbmqsxfph

  • MD5

    8315efc4d16754a5d02938270f6ca01b

  • SHA1

    085eb12a0bc268a05e8dcc0b796991a475192767

  • SHA256

    de0f393bb2ba0f8da0300dcd6c7c0db03b915222eed80e287b00b4b0a3c85b58

  • SHA512

    14be79780f196ce086cce25f43ac93d049df551dd12c68ef19aef3a3bfd046385d09feae24dcdcd17176bcaa39aa5cea005242348a5718f88e4bf172e3156c51

  • SSDEEP

    49152:HBNwyQG51moKIMzj8cVUy++WptIDWnOvm8W0LM8dAL4FedduLGRp+513:XZz11MzQGL++Wp0vvm58gduC6513

Score
9/10
evasion

Malware Config

Targets

    • Target

      de0f393bb2ba0f8da0300dcd6c7c0db03b915222eed80e287b00b4b0a3c85b58

    • Size

      2.3MB

    • MD5

      8315efc4d16754a5d02938270f6ca01b

    • SHA1

      085eb12a0bc268a05e8dcc0b796991a475192767

    • SHA256

      de0f393bb2ba0f8da0300dcd6c7c0db03b915222eed80e287b00b4b0a3c85b58

    • SHA512

      14be79780f196ce086cce25f43ac93d049df551dd12c68ef19aef3a3bfd046385d09feae24dcdcd17176bcaa39aa5cea005242348a5718f88e4bf172e3156c51

    • SSDEEP

      49152:HBNwyQG51moKIMzj8cVUy++WptIDWnOvm8W0LM8dAL4FedduLGRp+513:XZz11MzQGL++Wp0vvm58gduC6513

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks