General
- Target 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
- Size 9.3MB
- Sample260804-ppwt6awycz
- SHA256 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
- MD5 a5f990da4c50f2d58eff4f45b327f9a1
- SHA1 235b3f379c148af3d96a41784f6aa798a1e92747
- SHA512 a03471d5367b455f08da28f630d237e9401cd598a7a04f6297a611a7e762fa0b6209f28c8a95f31cd87237bedce226ca504e605d5ee8b60c72b7823f3fed785f
- SSDEEP 196608:PQ8/ReeOCVYcvYMOUUZkKuGDRsN8EYXtDJny60v3:jnAMO1/VsNstR
- TLSH T10BA633125C29461DC90D68F2CE96E3424D8BDBCE5570A0BB9D7AF166FCF280394E634B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
- Size 9.3MB
- SHA256 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
- MD5 a5f990da4c50f2d58eff4f45b327f9a1
- SHA1 235b3f379c148af3d96a41784f6aa798a1e92747
- SHA512 a03471d5367b455f08da28f630d237e9401cd598a7a04f6297a611a7e762fa0b6209f28c8a95f31cd87237bedce226ca504e605d5ee8b60c72b7823f3fed785f
- SSDEEP 196608:PQ8/ReeOCVYcvYMOUUZkKuGDRsN8EYXtDJny60v3:jnAMO1/VsNstR
- TLSH T10BA633125C29461DC90D68F2CE96E3424D8BDBCE5570A0BB9D7AF166FCF280394E634B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger