General
- Target Release (1).rar
- Size 6.1MB
- Sample260728-azelasvdjb
- SHA256 256c193278c79b8e7a63d2cbafc3c5b6f563e81c4d289875279e2bdc471a6ebd
Score
9/10
Malware Config
Targets
-
- Target Release (1).rar
- Size 6.1MB
- SHA256 256c193278c79b8e7a63d2cbafc3c5b6f563e81c4d289875279e2bdc471a6ebd
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target driver.sys
- Size 8KB
- SHA256 fd4a1eb46a25b5e687957300aab62074cf36a7905bbbd0cb0809c150d5f5facc
Score3/10 -
- Target map.exe
- Size 138KB
- SHA256 57832f7a25c5cd0dfca09c54d0019e4f19a0d27a949a92dc68baf35b72be8211
Score1/10 -
- Target selium.exe
- Size 6.1MB
- SHA256 e338e0d5e88f2f5850b0711b05e57bc0e938cde580124befd284dba2ae6b5b9a
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1