General
- Target resight-v1.3.zip
- Size 107.3MB
- Sample260625-xrmy2aew3x
- SHA256 5b755f2427b2262389287b9fc654c172237268625352397bd7dc86347bd48d36
Score
9/10
Malware Config
Targets
-
- Target libs/core_39.dll
- Size 710KB
- SHA256 b75f5d5c50fb74e5593ad93e0706ab07fbe0439658ebd758f1bdccabdd479001
Score1/10 -
- Target resight.exe
- Size 73.9MB
- SHA256 0b182f02f6427e9b7187cf2e00149279a0e85d0e438c1ff7e57095b1c570b067
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
- Target src/core_39.dll
- Size 710KB
- SHA256 b75f5d5c50fb74e5593ad93e0706ab07fbe0439658ebd758f1bdccabdd479001
Score1/10 -
- Target src/meta_20.dll
- Size 601KB
- SHA256 512a484d1ff8c8e76899f1461b834ff0eb6f983fe635c4e7d31accd9ca620bc7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.