General
- Target CometSploit.zip
- Size 23.8MB
- Sample260805-pg7xfs1yf1
- SHA256 4baba6d20eab8212349532a64d42b1145838742de6f70660a03826e76a4402f9
Score
9/10
Malware Config
Targets
-
- Target CometSploit.exe
- Size 53.5MB
- SHA256 55e2c76a8ae0cfbc305808024bda54b069e31f7a3c994c1be85ed833635cfe68
Score6/10-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target bin/Loader.exe
- Size 3.3MB
- SHA256 c113ee4cd4e63b9b044c1f6727f82bde3faf07dc96ae021375e1677470f45825
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target bin/Module.dll
- Size 1.9MB
- SHA256 05dd7e0ce501f5237d5521f4afc18dc3ea3d9c860ca3e5dd1ae87eadb065f277
Score1/10 -
- Target bin/decompiler.exe
- Size 373KB
- SHA256 4bd3bfcf1a3c8c4498fd7402fde0930559296243316ff71f78f204b30c88d4aa
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1