5ef0dbf018e3f87bfe4bdbdd85f93b46b0412bda31e7dc14f29c299550047341

General

Target
(UNSAFE) Code_Virtualizer_x32_x64_v3.2.3.0_Retail_Licensed.7z
Size 31.0MB
Sample260718-tsw2jsfv8n
SHA256 5ef0dbf018e3f87bfe4bdbdd85f93b46b0412bda31e7dc14f29c299550047341
MD5 09156a9442e012da1c80ad2e563a1b52
SHA1 746eea0596f8fb37d6ed5af0eff4fa334af9193b
SHA512 4cbfd69d96a66c715181dbb96307fba1bb8c65197e02e8d5881cc0ef1b328d1d5a0ff85fa59f03f3bfe31dcca2c870a0616c008d41387abc10c1dd2481d1f167
SSDEEP 786432:XOXoTX2ZirAZ5XNfxHhX5SkYzTiO1drF4dUZPbalYDb:pTXLAfNVhXKz+WrQUGlY3
TLSH
T1CA673332FBB5028FA6D0FC06073CE95AE5258676B6D0C9ECE5F7989C44A1F21C31D85A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  (UNSAFE) Code_Virtualizer_x32_x64_v3.2.3.0_Retail_Licensed.7z
- Size 31.0MB
- SHA256 5ef0dbf018e3f87bfe4bdbdd85f93b46b0412bda31e7dc14f29c299550047341
- MD5 09156a9442e012da1c80ad2e563a1b52
- SHA1 746eea0596f8fb37d6ed5af0eff4fa334af9193b
- SHA512 4cbfd69d96a66c715181dbb96307fba1bb8c65197e02e8d5881cc0ef1b328d1d5a0ff85fa59f03f3bfe31dcca2c870a0616c008d41387abc10c1dd2481d1f167
- SSDEEP 786432:XOXoTX2ZirAZ5XNfxHhX5SkYzTiO1drF4dUZPbalYDb:pTXLAfNVhXKz+WrQUGlY3
- TLSH
  T1CA673332FBB5028FA6D0FC06073CE95AE5258676B6D0C9ECE5F7989C44A1F21C31D85A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware bootkit defense_evasion discovery persistence ransomware spyware trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1