General
- Target 76089a25e76533661a8e8712847e024151b6c7b390634edd8cf1968d04917e57
- Size 9.5MB
- Sample260706-j5jxmsb141
- SHA256 76089a25e76533661a8e8712847e024151b6c7b390634edd8cf1968d04917e57
Score
10/10
Malware Config
Targets
-
- Target 76089a25e76533661a8e8712847e024151b6c7b390634edd8cf1968d04917e57
- Size 9.5MB
- SHA256 76089a25e76533661a8e8712847e024151b6c7b390634edd8cf1968d04917e57
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext