Resubmissions
19/09/2025, 19:48
250919-yjllnsgk5t619/09/2025, 19:48
250919-yjkz5sxrx222/05/2025, 03:10
250522-dn9h3sfn3z622/05/2025, 02:51
250522-dcdx2afk3z621/05/2025, 02:52
250521-dc448adp7x1021/05/2025, 02:41
250521-c6f4tadn8z621/05/2025, 02:34
250521-c2k7zavn16621/05/2025, 02:05
250521-ch6dsseq7s721/05/2025, 01:50
250521-b9hw5sxly5621/05/2025, 01:41
250521-b39raaxls56General
- Target visual.exe
- Size 12.2MB
- Sample250521-dc448adp7x
- SHA256 ef12d7c8167d4fe2d79a8faf27c2c681801e1d72f7ee2c8836ee665a78390a50
Score
10/10
Malware Config
Targets
-
- Target visual.exe
- Size 12.2MB
- SHA256 ef12d7c8167d4fe2d79a8faf27c2c681801e1d72f7ee2c8836ee665a78390a50
Score10/10XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
XorDDoS payload
Xorddos family
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Executes dropped EXE
Loads dropped DLL
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Mark of the Web detected: This indicates that the page was originally saved or cloned.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.