Checks BIOS information in registry

BIOS information is often read in order to detect sandboxing environments.

Themida packer

Detects Themida, an advanced Windows software protection system.

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Detected potential entity reuse from brand MICROSOFT.

Suspicious use of NtSetInformationThreadHideFromDebugger