General
- Target LisectAVT_2403002A_422.exe
- Size 3.3MB
- Sample240725-awtk2swhrm
- SHA256 e823e1e5b543fdeaa2f7c7225da5ebe469eb89b5a0d3eae7a23ede4b0abcbe44
Score
9/10
Malware Config
Targets
-
- Target LisectAVT_2403002A_422.exe
- Size 3.3MB
- SHA256 e823e1e5b543fdeaa2f7c7225da5ebe469eb89b5a0d3eae7a23ede4b0abcbe44
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1