General
- Target file.exe
- Size 3.0MB
- Sample260724-bbsnpazhkd
- SHA256 5b5785181f5017228be7f0cd094a4e9eef4a90dde8e9f927eefcab320efce782
Score
10/10
Malware Config
Targets
-
- Target file.exe
- Size 3.0MB
- SHA256 5b5785181f5017228be7f0cd094a4e9eef4a90dde8e9f927eefcab320efce782
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.