b756ea7f7bdb457e4e982c080668c268b573050bc3381492b2575036d75cb706

Resubmissions

20/06/2026, 11:32

260620-nnqfbaew5m9

20/06/2026, 11:18

260620-nelqrsew2m7

Sharing

Copy URL Twitter E-mail

General

Target
FOX OS PAID (BEST TWEAKS) (1).7z
Size 61.1MB
Sample260620-nnqfbaew5m
SHA256 b756ea7f7bdb457e4e982c080668c268b573050bc3381492b2575036d75cb706
MD5 68a9c5de8c17a4129f6d1f3247305858
SHA1 ecd3cc4523ada937c71b76d34655aa5d2fa0069f
SHA512 442c87e482c0c5ed28ef96051ab9b8e14375397a54f6a5ba35dc5c24e51248398ff92f433cf0cdd5539070a35ee4d0acfa00ec7c652b19ac955a4320a345136d
SSDEEP 1572864:toshOB0ejWMGGWlEoQmPh09B9IaR9ZwHy8zcRKPGv3K19LJzEfFA6KXY:vhk3tsPQl9DIO9mSdoPX9ap+Y
TLSH
T189E733D5B17659C7DAE913C4B7E24D9A88BB40D834A2C8C76BD804D40E835EA8DF7E70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FOX OS PAID (BEST TWEAKS)/Amd Bios Tweak By CatGamerOP/SPOILER_AMD_BIOS_Tweaks for Customer REAL_bytepressed.bat
- Size 17KB
- SHA256 e878525d4563b54cb51fdf0972c917c1761c181616afe51534cf43a70cd0095b
- MD5 83c58c8b4dabbd4b26b170813c53d631
- SHA1 cb9bf76d2b93cc1950546551c8c59bb7bba8ce12
- SHA512 b1b0c3d002504ac3534b822727a3619d60accfee38ee850719125e6deb6c2518d80a670189816229716e1518be7ac946df240729bec3c7acb03c5da73e7405a2
- SSDEEP 192:PJDCLNagI7fiNfZ+NxSg8tINl1yaKpAobO6ZXgrgCg5gwgng+mvkN/RNYfKz9mH0:PJDCkgI7mAxXdze8GLbbeL8jka8
- TLSH
  T1C182624A653BEC02F1E2E99748392811CA0701DF86C6E662F3BD1D751F6F9B4E40FA52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  FOX OS PAID (BEST TWEAKS)/Disable Event Trace Sessions by CatGamerOP/Disable ETS by CatGamerOP.exe
- Size 8.5MB
- SHA256 8687a42c7f89909cd142a08fe35203421c3e7f6a44bedf111a92e82a62d947d9
- MD5 8539a43543946460ecc638c05cbe3c80
- SHA1 0781ca4016be802132cb8943646587546528cb36
- SHA512 e052de1e14a9e7f3d36b02a62fd7cc3d7ffe568bb46cd2593cb16416fddc96f4c648a1cc5d1586419f7933a940f40b27ce3de72dfc506db0490ffb92523e6ed1
- SSDEEP 196608:1sNTwhL8exA1HeT39Iig9SvKub75bcjWgbPVk0ax8ozfl5kjKB8+:PL41+TtIibvB5IjWqPfaxrz4
- TLSH
  T1259633B162A71DE5DAB3433445A2844ADAE1FC862771C6C743B43E8E1F372ED4EB9610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral2
- Target
  FOX OS PAID (BEST TWEAKS)/Ethernet Driver Tweaks by CatGamerOP/Ethernet Driver Tweaks by CatGamerOP.exe
- Size 11.2MB
- SHA256 002bd329c7366fd3ca7776f842d17dcfa1ea4d27b5e329af4a74ccdf587ff9c2
- MD5 f4b524dfb07d0a8fe926223e372e338b
- SHA1 0a56169843d5089dd50d46cf5a1b6eba2e214e17
- SHA512 6e30500588d5c971016282c555f02f8b90ead20487919ca6c1bcc801b91e6e04afd30334e67d555009b2c02391ffd6e080a0f90915f59c0cc570a502560fddd0
- SSDEEP 196608:tIz/0W8/LSNTwhLCA1HeT39IigKPvKub75bcjWgbwau5thoANN9k0ax8ozf4Akjf:HW8LLL1+TtIirPvB5IjWqwau5thoA/3T
- TLSH
  T14BC63384379908E8E9EA633499D1CA175BE174A513F1C6C76BF80DC21E532D9EFB8720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral3
- Target
  FOX OS PAID (BEST TWEAKS)/Fortnite Strip by Foxy Tweaks/Fortnite Strip by Foxy Tweaks.exe
- Size 12.4MB
- SHA256 b3e619831a024d0fc48b3765a5b89665bbf1fccf6d0973d5d321b01686dec1c1
- MD5 bed60576efe133fbe180a7c1a7fc9152
- SHA1 2ec02648b3a0a13e8a1d06ef37f56ab4d28df591
- SHA512 35963ec7b6a267d28290217a313eea10b996ba7c672db4e6e9e6c0a48c479c6045ca358076dd08858e113d8d3e7644cfa3b9027f455462d8d010516c9226876f
- SSDEEP 393216:Dm1mZ/91FJ7L5ZLrhKGJbdq1B7LfHsoqEbpiJ:q1md9h55rhK2g1Nnlbp
- TLSH
  T1DBD633BA11C30D92E4B7923D4AA16592C1E2FC502B20C99B0B947E7D2F372FD9D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/Export.bat
- Size 529B
- SHA256 283d6ea32f1aa30985dc7ff1564e345ef62ca8193d764418b3031bbba82bb7da
- MD5 bf354baed02884dc4cf002db55818873
- SHA1 66475f4de3baf56280ead4fc7c1303f5acbad307
- SHA512 205c681c36b856f46c4cb91ae7adab2bd006c4950a660414dffd12ddafd23828d82a2128a19eef4cf05124a2b1237a8f1a3c50643479c91c0cef045df7c98134
- TLSH
  T137F0C0433B4A1F72C0B281738F1012D9F0C541172491C6A83C0C46B16F3C8704BE05C8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/Import.bat
- Size 739B
- SHA256 dc0f3e8f2d484742469d768266ca833fe7330d618770b628bcbaeb6bb40df6fd
- MD5 69ef99d985f7bc5e5e35471b251a84a3
- SHA1 36d08bc2cbf4cc6a1203fe1de18be71eac6a1cd2
- SHA512 f76067a1802be0dd45111ee85f9e69f989a716db962595b58898291ed3fd5178e0eb97c9c54742650b2969ab45184dedf6d8158975c93823c2b60117beec7b40
- TLSH
  T1FA01C0427E4D1EB7C0F29573CE2021D9E58A811B3591D9A93C8C86F2AFBC8744BE46CC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/Intel BIOS Tweak by CatGamerOP.exe
- Size 15.5MB
- SHA256 492f07ca3b12ee2f0977da7e8d9fa733d78c3877c972958be67c51ace2981bdd
- MD5 56aad06970de12fd29ea69843ee7eb74
- SHA1 de38015470b48b05f538be04c699ec3658d6674a
- SHA512 561dc674a6a0b7a8fc82ac3d6f2d5b768750f1c6f8b3a975da550c321e7610ce27f14f73fd1581b58129ef2becc8d2f687214cd6bdd3070629e1caa0f41a7b72
- SSDEEP 393216:WFu1tZ/91FJ7L5ZLrhKGJPdq1B7ZeXpcHsoqBbpiO:Wo1td9h55rhKeg13a8nIbp
- TLSH
  T16AF633B623C70D90E46AA23D96E15A57C1E1FC601B20CE9B1BA07DAC1E371EDED31B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/SCEWIN_64.exe
- Size 668KB
- SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
- MD5 d89e8173dc0b82d80add7451d4aa4622
- SHA1 578358cd958756b1786f30e913e4195c0003333c
- SHA512 cb5e4ebf895b5414b70caa243d032ec1d8820ff3aac155aa065a449f3a3f7ef0b01a29b006d49c69c8c1f8c11235742f0a453b120132942d32d310c7b2d3808a
- SSDEEP 6144:Jk/u4+ss7CVVs7DYebnaGSEM1JLCUdDcwDfTx1ZdeuLJzVpEKz7k32lobAYBhXcP:JTjC/s7DjkDZdeuLHuEm2ybAYBc/3+s
- TLSH
  T11AE40956E7F351E8D8B6D03489A22236FAB178548738DBC78794860B0B72FF0993E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/amifldrv64.sys
- Size 28KB
- SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
- MD5 e5e8ecb20bc5630414707295327d755e
- SHA1 06ecf73790f0277b8e27c8138e2c9ad0fc876438
- SHA512 f8949a43b5d0b08349b719daac12089fd94e824e307ae5265fd39885029a19a91d35a45dd3f3ff41cd0e3d563d4419d96221212d96b5a9a10e5ebe952dfb16aa
- SSDEEP 384:xv+wvxzpsQbQS5Z5OxV0HM2DecoLiZFnJtQSZsHLPK6jzHpNMbvFRJl6p+w:xvPvxtV5lgCM8eBLgJt6PKgDpNMPO
- TLSH
  T11CD23B91C6789C43EEA3DD3062F8E6177E34B6822760C6DF4165D4904F92BD2AB3C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/5.05.01.0002/amigendrv64.sys
- Size 34KB
- SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
- MD5 7b9717c608a5f5a1c816128a609e9575
- SHA1 ec457a53ea03287cbbd1edcd5f27835a518ef144
- SHA512 4138ca89d0d74799ff10e512c247ea626846d107f0e054aef403adafeb7c7708415cb9e4ce7dbf0d168e98101f9faf5d5d3567ca7fc64406f72b1bd7a751664c
- SSDEEP 384:79TBPBgGLd6veRHilu/XWncQ528rQjX+kl811pZFnJtQSZsHLPK6jzE9bvFRrqP8:pFsvSClu/mRH8lklJt6PKg49Puti
- TLSH
  T159F24C9197B44886FDA79E3062E4D2277E75F7923A30C7DF0160D0641FA3BC2A63835A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  FOX OS PAID (BEST TWEAKS)/Intel BIOS Tweak by CatGamerOP/Intel BIOS Tweak by CatGamerOP.exe
- Size 15.5MB
- SHA256 492f07ca3b12ee2f0977da7e8d9fa733d78c3877c972958be67c51ace2981bdd
- MD5 56aad06970de12fd29ea69843ee7eb74
- SHA1 de38015470b48b05f538be04c699ec3658d6674a
- SHA512 561dc674a6a0b7a8fc82ac3d6f2d5b768750f1c6f8b3a975da550c321e7610ce27f14f73fd1581b58129ef2becc8d2f687214cd6bdd3070629e1caa0f41a7b72
- SSDEEP 393216:WFu1tZ/91FJ7L5ZLrhKGJPdq1B7ZeXpcHsoqBbpiO:Wo1td9h55rhKeg13a8nIbp
- TLSH
  T16AF633B623C70D90E46AA23D96E15A57C1E1FC601B20CE9B1BA07DAC1E371EDED31B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  FOX OS PAID (BEST TWEAKS)/Nvidia Driver Strip by CatGamerOP/Nvidia Driver Strip by CatGamerOP.exe
- Size 11.2MB
- SHA256 8cc93489c7473feafc71bee71dbd99f6828fa77fb93f13cc27ecb41ccdfcaef6
- MD5 ca4abb212d7def9ffc402e6a5bc98544
- SHA1 6c423a38f7e7f6193c3f210c8d5b9ba4b272a3fa
- SHA512 b0f614e9800f2875bafe64e891294baa35467bcafb6f2d6b6e11ede4457bfde77c5ecdbc6a74a13f75a98a567676cefbadcaca1dedcf40f36f36da24ac2070c4
- SSDEEP 196608:zY/0W8/LSNTwhL0A1HeT39Iig9hvKub75bcjWgbwau5thoANN9k0ax8ozfh5kjK1:TW8LLN1+TtIimvB5IjWqwau5thoA/3ai
- TLSH
  T126C63380339918D8E9DB533499D1CA2B9FA274A553B1C6C717F80DC21E632D9EFB9720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral12
- Target
  FOX OS PAID (BEST TWEAKS)/Services&Drivers Tweak by CatGamerOP/Services&Drivers Tweak by CatGamerOP.exe
- Size 11.2MB
- SHA256 a81c90c74932a9d1f5cda6de0c6f66c8e07c3f2a858fd9a866c0a19d8768f6fd
- MD5 8d639a394d8af051227e267e67fd025c
- SHA1 0f1753bbce9b63e30c2e9d76e27f12be1823fad9
- SHA512 69330aba5175115c345760d02afde821693b2313929fbac9242db871a3b0594787703192e1e856669ae7cbde74473246680c9566a151fb335d3fd8f5105e4134
- SSDEEP 196608:qyi/0W8/LSNTwhLCA1HeT39IigKWvKub75bcjWgbwau5thoANN9k0ax8ozf4Akjf:FW8LLL1+TtIirWvB5IjWqwau5thoA/3T
- TLSH
  T1D7C6338037990CE8E9EA533499D1CA175BA274A513F1C6C76BF80DC21E572D8EFB8760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  FOX OS PAID (BEST TWEAKS)/Task Scheduler Tweak by CatGamerOP/PowerRun/PowerRun.exe
- Size 891KB
- SHA256 4545392a2d54b613e67fc801ca478b89f69f9adbf7e7e6fafbe424fb26b97abd
- MD5 819a19117d17c92e08eb85a2262727d3
- SHA1 bcc884921ed8d23a40ebeb2e134cba50c95959ab
- SHA512 1d0d50c96dd2014923633c82f2a4f1baf9e84246bef0a8e6504682042b93479e9fe7386e80ddfbd3098d4181fba0e8a9d96709cb92573c4dcde77d7b7b842ee8
- SSDEEP 12288:qaWzgMg7v3qnCikErQohh0F4aCJ8lnyrQP8tbb9ROjEn4N5iTiDdYXxFGJ:FaHMv6C0rjynyrQIbnOwn4N5iTiDm/GJ
- TLSH
  T13415CF52B7D680F2D99239B1197BE727EB357D190726C4C7A7E03E768E311009B3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  FOX OS PAID (BEST TWEAKS)/Task Scheduler Tweak by CatGamerOP/PowerRun/PowerRun_x64.exe
- Size 1.0MB
- SHA256 b066ca2702853c2fcbf686897c18f6d315be7ae753007ac2c1d73c87b0a30de9
- MD5 ab06eeb603656d3943cd30396f82a45f
- SHA1 1a12519bdeb372e8b1836d78ec61617bbac166aa
- SHA512 74e4752cd6e36a6b517685ec93ba8404a0c3c51a21cfdcc12498c896cfcf4a0ea14af1cd512471f9d3dfb19e80b28b275fb1ecedc6a5ec07faeb5fff3a60ff56
- SSDEEP 24576:02DW/xbqX2YIb4Qsu3/PNLZQeHy0ed1uli7:02EWXtQsW/PNdQ2gMlu
- TLSH
  T16C359E59F6A444F4C47AE1B6CE56C12BE2F1BC08477597CB06607E6A1F33BD0693A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15
- Target
  FOX OS PAID (BEST TWEAKS)/Task Scheduler Tweak by CatGamerOP/PowerRun/SID_Example.bat
- Size 1KB
- SHA256 5a296e04fa900c4999aee9e449fb6c928176dcca82aed0338f8edeae5743b69a
- MD5 bafcdbf4c34dd286b59b0829ae6a38c9
- SHA1 f434674d8c647e113cf66a412f97844697440019
- SHA512 00d536ea84fd424c229893b901b3b7b927fc86f6f7df5c4622f383566cfde7e41f4ab953aa77df933f1f2baa80f3d6b85268b2a9c204107cb69120dcdfd72fb1
- TLSH
  T16E21354E085F834212E22E51952DA037FBF1D92378F0594E78F4195C61D39DA4B5D8DF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  FOX OS PAID (BEST TWEAKS)/Task Scheduler Tweak by CatGamerOP/PowerRun/Task Scheduler Tweak by CatGamerOP.exe
- Size 11.2MB
- SHA256 0572f26706338b1165b02f5175f2174ff6991c72c4c18c7740e3bec176f78c97
- MD5 7de3deb4846a7dbebd06a7bdaf45c030
- SHA1 bd879d186659ff3efb9d12642c20ce3be7308ed1
- SHA512 a56ca547bf05abf6444e528f115aac887d03280513688d304b5f4dbfe4c6f9e8a499cdce0ca5a81a0aab28079bafeaa3c7c74ff041d09b38c3a87c42414c7659
- SSDEEP 196608:Z/0W8/LSNTwhLOA1HeT39Iig9kvKub75bcjWgbwau5thoANN9k0ax8ozfh5kjKBH:CW8LL31+TtIibvB5IjWqwau5thoA/3ai
- TLSH
  T1EBC633B0339B0C94E9AA533499E08A169AE1FCA557A1C6C757F43D8D0E732DCEEB4710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral17
- Target
  FOX OS PAID (BEST TWEAKS)/Task Scheduler Tweak by CatGamerOP/Task Scheduler Tweak by CatGamerOP.exe
- Size 11.2MB
- SHA256 0572f26706338b1165b02f5175f2174ff6991c72c4c18c7740e3bec176f78c97
- MD5 7de3deb4846a7dbebd06a7bdaf45c030
- SHA1 bd879d186659ff3efb9d12642c20ce3be7308ed1
- SHA512 a56ca547bf05abf6444e528f115aac887d03280513688d304b5f4dbfe4c6f9e8a499cdce0ca5a81a0aab28079bafeaa3c7c74ff041d09b38c3a87c42414c7659
- SSDEEP 196608:Z/0W8/LSNTwhLOA1HeT39Iig9kvKub75bcjWgbwau5thoANN9k0ax8ozfh5kjKBH:CW8LL31+TtIibvB5IjWqwau5thoA/3ai
- TLSH
  T1EBC633B0339B0C94E9AA533499E08A169AE1FCA557A1C6C757F43D8D0E732DCEEB4710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral18
- Target
  RegFromApp.chm
- Size 14KB
- SHA256 72336f3128f5287aefd47302b9ef9c1b7ea4aae70e0a69d2254c033ea406fe97
- MD5 c27adfd1e08ee7214d5c7ecfa054d432
- SHA1 b6228a8c850e2614c3eda22e0e284cf359c73efa
- SHA512 37d9350b800b0f0cca212f9938e061f97b01d73db084ec975a46be68635aac98be91b39739a9b731fef6aef62b802767a14c9a64108ab9892c26257aa6549e2e
- SSDEEP 192:RZx+q7UCBaymVQqCahNMydtk1olTgomm0:RZx15m7CahNMz12Tgzp
- TLSH
  T12C62AF24F73A4730ED14C67D7BCB1955264DADC1FA44235B5242831B8693B8A9E0CDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  systeminformer-3.2.25011-release-setup.exe
- Size 22.6MB
- SHA256 7612d5e44a5a392ab9f0d1b5b8a79bda3cdbe19848e8ee9ec23909aaf3daad45
- MD5 979b20755ddf86eddb3e2892003a2ca6
- SHA1 3a0b6f9ee4ee12872e733948465be5ece5b25629
- SHA512 3238f77f7810460cb7cdfe7692892879c28e14ccd95969e80cf83d1dff320c8354173a87503b893b7095b99ee81c61e195004ad5f5e6a28e09e3e9c1fc080d44
- SSDEEP 393216:Cg+SqZ3hd0y0HNQvVun6kljEGVHXQYGSE1fggY6Q1Gv0ZOfBKy48/ZtwnvmFO4lL:CB/Z3hd0heVu8GyYGSE19eGv0Zvyd/31
- TLSH
  T1F5373390F6B242E4E9F1177069A3EB19907C28D01F2489FF0BE95C845FB16D1973AF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20