Extracted

• • Target
    _c03eed16fc03200c480b0c86a170a1f77a32fab582ff8571b7efbb63df8d9611.txt
  • Size 575B
  • SHA256 c03eed16fc03200c480b0c86a170a1f77a32fab582ff8571b7efbb63df8d9611
  • MD5 b2c85e12c003bfa1e6a725071dbe1a72
  • SHA1 4214696a2c7657296d72c3ecf430b741152df52e
  • SHA512 c954f99009648494426fb7ecbb3947ff2874b12a5bdcc7d0f469c5a47feea4f8a95e40924240b301ca2f9be8a2ec5d2fd7cb614c188aea8cfd8895f67f449e3e
  • TLSH
    T194F0E109BA70F25001319A25DEF2E89DFC9F40AB542373042374CB159F3512E8B15146
  • MD5 SHA1 SHA512 TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutioninstallerpersistencetrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2