General
-
Target
file.exe
-
Size
2.7MB
-
Sample
241109-gqbavayhlb
-
MD5
d26eb5b536002ea2fb80ba819837e990
-
SHA1
cd2f2cf0bad37ef840bc21db8cc5d775abda464b
-
SHA256
4b552ffd722694650fd6197fdfdd2412fb19ae35e4effedffdd628f713b9a740
-
SHA512
35dbc72513c066f2a23d9e941ddb29e53d03c76e2cec601d8fc1687d72453ab62fc31896779d4d270d1e99abd07154410e95dddf23f92674a504f5ab84ca9c09
-
SSDEEP
49152:CQCfUFG+Dhu12Cc5rAbMjdIh13PtrdEqw3HHaMq:CQCfGG+DA12ThAgjdIhRPt+l3Ha
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
file.exe
-
Size
2.7MB
-
MD5
d26eb5b536002ea2fb80ba819837e990
-
SHA1
cd2f2cf0bad37ef840bc21db8cc5d775abda464b
-
SHA256
4b552ffd722694650fd6197fdfdd2412fb19ae35e4effedffdd628f713b9a740
-
SHA512
35dbc72513c066f2a23d9e941ddb29e53d03c76e2cec601d8fc1687d72453ab62fc31896779d4d270d1e99abd07154410e95dddf23f92674a504f5ab84ca9c09
-
SSDEEP
49152:CQCfUFG+Dhu12Cc5rAbMjdIh13PtrdEqw3HHaMq:CQCfGG+DA12ThAgjdIhRPt+l3Ha
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2