hxxps://wearedevs[.]net

Resubmissions

12/07/2026, 17:22

260712-vxmt4sgs5w9

12/07/2026, 17:16

260712-vs55wsf17t8

Sharing

Copy URL Twitter E-mail

General

Target
https://wearedevs.net
Sample260712-vxmt4sgs5w

Score

9^/10

defense_evasion discovery

Malware Config

Targets

- Target
  https://wearedevs.net
Score

9^/10

defense_evasion discovery
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

urlscan1

behavioral1