f8406bd30f2787a1707a13e85c1bae90ac274fc090525c0f19511fa71622fb73

General

Target
10366.zip
Size 8.9MB
Sample260724-w2dmnsab49
SHA256 f8406bd30f2787a1707a13e85c1bae90ac274fc090525c0f19511fa71622fb73
MD5 de8afd759178a81cf5cff9bfd8e1bc9c
SHA1 61ce33c5aab5dfb0f98f36bf4a82b44d4b1d0668
SHA512 f7501ffd9bbd401e95a5157281cb56da0347218cf7a0e04e6b278e9eaacc25f731d194b09224fa749c5b8f78e7a0ac37c8bd2c659a0888e431ade33057b8d8f2
SSDEEP 196608:J+Zp7bNfUSEUHc6KzDxe+Zp7bNfUSEUHc6KzDxR:J+JfRL86KzE+JfRL86Kz3
TLSH
T1509633808E5099B69BFB2C414B45F06B53846B164075C60FEAF1A939FBDAFC266D303D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Env_DX8/GuardShield.dll
- Size 4.5MB
- SHA256 4ff4b76dfa55141ff5cffde7133a732ea8a31151e70dc1910427585e02dda065
- MD5 ae73b225bfeadfa7e144a18c9ad13d0d
- SHA1 cc35717092385b088f2f40a83bf5a5b035ec7b6d
- SHA512 1de1709c83403e2fdc2ff67586bf016904d7dd2ec280cef6bf2475bf228da71f1d59178ca9d8b790d39f27b945e159d45f6574a45c3c436f5fcdf9d2b7602cdd
- SSDEEP 98304:9mNfVtjP3y2DW87JVXOm7D7nVW0odkgCKLjbhKoX3zxJQ7a:iVtjPCTUfOm7fVBtebjHzxC7a
- TLSH
  T1EA2633F4D8185CEAEA22EEF35E0114041A9CE84D4742D3A3E83F5E6D650AF1EEB77524
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Env_DX9/GuardShield.dll
- Size 4.5MB
- SHA256 4ff4b76dfa55141ff5cffde7133a732ea8a31151e70dc1910427585e02dda065
- MD5 ae73b225bfeadfa7e144a18c9ad13d0d
- SHA1 cc35717092385b088f2f40a83bf5a5b035ec7b6d
- SHA512 1de1709c83403e2fdc2ff67586bf016904d7dd2ec280cef6bf2475bf228da71f1d59178ca9d8b790d39f27b945e159d45f6574a45c3c436f5fcdf9d2b7602cdd
- SSDEEP 98304:9mNfVtjP3y2DW87JVXOm7D7nVW0odkgCKLjbhKoX3zxJQ7a:iVtjPCTUfOm7fVBtebjHzxC7a
- TLSH
  T1EA2633F4D8185CEAEA22EEF35E0114041A9CE84D4742D3A3E83F5E6D650AF1EEB77524
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4