General
- Target SeksLoader.exe
- Size 497KB
- Sample260619-w2nsmsax9k
- SHA256 2e9f108cf1c981cf608255b043d1761039f31ea2bc385edd27afadf081d605cc
Score
9/10
Malware Config
Targets
-
- Target SeksLoader.exe
- Size 497KB
- SHA256 2e9f108cf1c981cf608255b043d1761039f31ea2bc385edd27afadf081d605cc
Score9/10Enumerates VirtualBox registry keys
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger