2ec9375bae34778a52683db1bb2f78facf5496c42ef9bbb64dc7df0ce892bc14

General

Target
10372.zip
Size 8.4MB
Sample260724-w2dmnsab52
SHA256 2ec9375bae34778a52683db1bb2f78facf5496c42ef9bbb64dc7df0ce892bc14
MD5 d44b8851eaaf260c7aaa3244e3545a97
SHA1 7f9bf1cffe35c6bb709d818a489681209cbcd07a
SHA512 edf33a9b662e3ac45b0a904ac79edc96c8371e2d36caaae0eae72194183df1b4a5feb88a7319763a54c632723f537e8b1299ef4451e940d5f1248ea2fc097a3d
SSDEEP 196608:e1fEseCvfYW9yxQVq3GLJQn1fEseCvfYW9yxQVq3GLJQn:ep/eCvwW9rMqAp/eCvwW9rMqK
TLSH
T16B963359E0A1ABFC19CF5C34A44B660EB2637C6326941C8B57E0696CF98F3B930DDC58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Env_DX8/GuardShield.dll
- Size 4.2MB
- SHA256 4b534cf04d3a7a4363113e28d203e7e966aa4230625dd33878d430a63d80ee08
- MD5 349bacfbf520927287f9a46c27a7a30c
- SHA1 f205b3fa7beb314604e10efe11883957c98e7b9a
- SHA512 609b6a87d808f7e743e4518e26f93cb2777c55d8a08dec7a9aaaf3475fc918290c18092fa9655f2f7c8f74a1c59f705b176c22eeb99c39b97067570ffc56984b
- SSDEEP 98304:UGZykguQ2dr2SWMRGGMoG4AqHLLhDXumXTX81/+RGu4KCq:vZy1eDfRGlLkFDfDNRphCq
- TLSH
  T1D61633A1B940BE63CE11D674ECE96F0350932F655156B786EA2F7E86C803D8CC7D90AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Env_DX9/GuardShield.dll
- Size 4.2MB
- SHA256 4b534cf04d3a7a4363113e28d203e7e966aa4230625dd33878d430a63d80ee08
- MD5 349bacfbf520927287f9a46c27a7a30c
- SHA1 f205b3fa7beb314604e10efe11883957c98e7b9a
- SHA512 609b6a87d808f7e743e4518e26f93cb2777c55d8a08dec7a9aaaf3475fc918290c18092fa9655f2f7c8f74a1c59f705b176c22eeb99c39b97067570ffc56984b
- SSDEEP 98304:UGZykguQ2dr2SWMRGGMoG4AqHLLhDXumXTX81/+RGu4KCq:vZy1eDfRGlLkFDfDNRphCq
- TLSH
  T1D61633A1B940BE63CE11D674ECE96F0350932F655156B786EA2F7E86C803D8CC7D90AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4