General
- Target photo0418699.com.exe
- Size 622KB
- Sample260418-1t5hmsgx5k
- SHA256 4d8c02745ed4c2bcd9bdb425d5763ebd1e6da459c1877fe9d0005e477622aa6a
Score
9/10
Malware Config
Targets
-
- Target photo0418699.com.exe
- Size 622KB
- SHA256 4d8c02745ed4c2bcd9bdb425d5763ebd1e6da459c1877fe9d0005e477622aa6a
Score9/10Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Suspicious use of NtSetInformationThreadHideFromDebugger