General
- Target ST_CS2_Cosmetic.zip
- Size 14.4MB
- Sample260801-qc5f7sba69
- SHA256 5cc32e24df9f67689d319f9a695466a4f3c48773e4ff305a4907da721300bfd3
Score
9/10
Malware Config
Targets
-
- Target ST_CS2_Cosmetic.zip
- Size 14.4MB
- SHA256 5cc32e24df9f67689d319f9a695466a4f3c48773e4ff305a4907da721300bfd3
Score1/10 -
- Target ST_CS2_Cosmetic/CS2_Injector.exe
- Size 30KB
- SHA256 3dbf9114c40f8f76c07a1dff4e5eba6e05c0ba3bf0c530e491df8132d5b93f7b
Score3/10 -
- Target ST_CS2_Cosmetic/README (STEPS).txt
- Size 756B
- SHA256 5629b9f1330760126bab7a27c11e0ee6a4b15df6f00541ccb5463c738d4450c0
Score1/10 -
- Target ST_CS2_Cosmetic/SkinChanger.dll
- Size 14.5MB
- SHA256 9163f54b52609853cbd234646433f24aa5c6e56786dbd0ad0dba1354b2cf382e
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger