General
- Target zip.zip
- Size 168.2MB
- Sample260727-llymsszdke
- SHA256 9333c09950456392eed8c7bf2b20c2d004c64f91551678636869d4551c0790f9
Score
9/10
Malware Config
Targets
-
- Target CdiResource/vc_redist.x86.exe
- Size 13.2MB
- SHA256 5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
Score4/10 -
- Target Setup.exe
- Size 19.9MB
- SHA256 92312bb8eb9260fe084b2e1394073f7d4f47ef85ecd56ddd38c97bf7a775310d
Score9/10-
Looks for VirtualBox Guest Additions in registry
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Looks for VMWare Tools registry key
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target data/install.dat
- Size 158.3MB
- SHA256 da3051dedd40907c10f7c5705d5deaca758b6a4f160602130293334f418d7d38
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/svml_dispmd.dll
- Size 18.0MB
- SHA256 ae919450562b7d7a01b09f8879d12197932e0c99901c67287e55202defd04deb
Score1/10 -
- Target icudtl.dll
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
Score1/10