fe2d2fb8ba761d9026e682dd9d291e3e8c1b64093e85516675d1697f51e531b7

General

Target
FzSpoof1.0.1.zip
Size 12.5MB
Sample260511-17gnqsbs2t
SHA256 fe2d2fb8ba761d9026e682dd9d291e3e8c1b64093e85516675d1697f51e531b7
MD5 7e11a29a1eb653b991eb4f2f97760266
SHA1 c9243ef8a5033a9a41243d6ead1edd9722c99e31
SHA512 c686ffb0cf40667c9551cebb66941a6be2d70be2c27facbbed4c24826d94a1f642f2bd5d4a85c17c81bdbd639f3856ee670d1def1e7947908b8e0b4dcc6cff23
SSDEEP 393216:WJan01BSN4YDpb1OjfaRxH24H5oIsKL2GKkpaHyY:TnkYG2pbgjJ4ZoIHL2CaHr
TLSH
T13BD633EF829F513D20CF62A13A7CA05954233E6452348AD789E2C43DBF9993E9C0DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FzSpoof1.0.1/KernelDriver.sys
- Size 7.7MB
- SHA256 2956c88d7ac8cdbf5d218651cccdf2c552e9e61734676b0e69060dab09c8af5c
- MD5 024ae4812344d1e3a9b52668deae73f0
- SHA1 8b0d8050149cf027250fec67b27c74ee69bc5a63
- SHA512 05c9bad97bc23701351a2a6a3439cbdf19b62b51049a0d1ca523e87c1b72f81a461b7c5b1130d7d9b958f9cce8a0ae1f23a84133a771737f8ac24a0dcee88f7a
- SSDEEP 49152:TVI4ic7xPkyVV5elGXBJ6Ott3y/DM6Lx2ni/IbH2bcAkjSYzh2Q6pcE9tiy2l1I9:skBQa3xhWwRyjeK
- TLSH
  T17786F8E330D711A8C816DABB8743FE5FD69F323E4936EDD3A258E1524825C507E06E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  FzSpoof1.0.1/Spoofer.exe
- Size 8.5MB
- SHA256 8ab53ca44a6d06a1b68ca267c7fb06582d0a1c319c40dab80bbbc60f4fb6a677
- MD5 29b9ec7aab8897243a3db7bcf41473eb
- SHA1 0711b779df76716f0d4945917405d133c6714eed
- SHA512 1dd0040bd2d9a39f082c5a4e8d8d53a20897128f55df5288e56071c1a6023bbc8d8fae3d0786fe9a1840ce2265932971f97251c1c702353b325dbcef059c85d9
- SSDEEP 196608:bXvavjjWki6uwiIT0SrDDiTyqZQZr5RMYcXkCK1HIx0i3R:7varjnh0IT0SrDD8yq8Rrc5qoew
- TLSH
  T15D96336A6C64CA6DC08CEA30FD8425F9B3163DD2CE74DF53844994BBBC0954DAF4A878
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2 behavioral3