General

  • Target
    24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
  • Size 9.3MB
  • Sample260804-ppwt6awycz
  • SHA256 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
    • Size 9.3MB
    • SHA256 24bbc4bfd589d9cdf96640a34c82ad27a70de1b52176efdd3643d9b0e9dfdff7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Executes a VBScript file via the Windows Script Host.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks