General
- Target Installer_v3500_x64.exe
- Size 18.1MB
- Sample260802-ralfzsthpe
- SHA256 1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48
Score
9/10
Malware Config
Targets
-
- Target Installer_v3500_x64.exe
- Size 18.1MB
- SHA256 1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48
Score9/10Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Executes dropped EXE
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks whether UAC is enabled
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1