General
- Target 851d789527a3f10770f3a105b1b2c773438099f1439c71212b5d21ce97d4eb6e
- Size 10.6MB
- Sample260808-wh726swthz
- SHA256 851d789527a3f10770f3a105b1b2c773438099f1439c71212b5d21ce97d4eb6e
Score
9/10
Malware Config
Targets
-
- Target 工具.exe
- Size 6.8MB
- SHA256 f2071dfedf677961cbdabfb9ac7d2f4a6867d205fe37be5d818b3d1b3d60eb1e
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Drops file in Drivers directory
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target 驱动.exe
- Size 3.8MB
- SHA256 3b0311aaea8b65ac177c7724614c6d4fa47a9d8465ab1d84fe21493aecceeb08
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger