General
- Target BacteriaGrabber_0.rar
- Size 3.1MB
- Sample260721-bke4yscx2w
- SHA256 af6d4152cf9e0d9974e5a776dcb61795909e4e3d2b79fc87a312248a2ebf5602
Score
10/10
Malware Config
Targets
-
- Target BacteriaGrabber_0.rar
- Size 3.1MB
- SHA256 af6d4152cf9e0d9974e5a776dcb61795909e4e3d2b79fc87a312248a2ebf5602
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target BacteriaGrabber.exe
- Size 2.3MB
- SHA256 ffcba5c92b8d7337d140e25e6c4b7b1b6cba499be168510422a52b81507c494d
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Guna.UI2.dll
- Size 2.1MB
- SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
Score1/10 -
- Target dnlib.dll
- Size 1.1MB
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
Score1/10