b54d65fc5ffd4fe0fb644b14fa82158222a74abe2b10470082b5c46f0071b1ec

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 226KB
Sample260602-3vs74sgv8r
SHA256 b54d65fc5ffd4fe0fb644b14fa82158222a74abe2b10470082b5c46f0071b1ec
MD5 718ff33ac85f4bee60ba038c6c53e461
SHA1 f28010b444e9b5e332b7408a4e50eafb203209be
SHA512 3986e2d4fb9b9c51c219e6ed2f307e751356dc61221de7562a0d68120ce9607b0d28a7233176a7faa7c48a816cf050ee3c227d9d2a468125320790c4698ae73f
SSDEEP 3072:vjD5sxuXwyKdlyZyPEsT1PYefzUpBrYO9zSAQYvXiUSO6Bjvjk:hXJKdg8YefzGr19xviUd6
TLSH
T1E6345D19A6A50DFDE677C1B8CA525902EB32FC460371EEDF079019A71E236D48E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	test.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	test.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	test.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	test.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmware	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5092	test.exe
5092	test.exe
5092	test.exe
5092	test.exe
5092	test.exe
5092	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
PID:5092