General
- Target 7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621
- Size 250KB
- Sample260814-g1lvbsff85
- SHA256 7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621
- MD5 e4c52fdc323594d59f04ed27827c08f2
- SHA1 3b0906c53a539f654a0540f6c1854d63078afe89
- SHA512 91ae5224f6bfb94513305b5adbf6a1c2cdb15cd9330293d64214f83baf571671f88f7a31a814caa84dc9ec78e57b0350152e703be21c77b6b096ab39da4f96d9
- SSDEEP 3072:2Sr17uZrFB7YQOi0iqkXQtqZ7Lt8fx6TM36+SsYOI4MKFo4AnhKxQwIaZo//DVHo:25rFBEc0iz5qSZxKG4AnhKxQqoRBSF
- TLSH T11A445C21E6D405FDE637C1B8CAB7DA47EB72B8464370D58F53A01C561E23960AF39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621
- Size 250KB
- SHA256 7deb4fb94890dc0f598b8c9c03fbe0770252e9d68caf088603ef6f72c8038621
- MD5 e4c52fdc323594d59f04ed27827c08f2
- SHA1 3b0906c53a539f654a0540f6c1854d63078afe89
- SHA512 91ae5224f6bfb94513305b5adbf6a1c2cdb15cd9330293d64214f83baf571671f88f7a31a814caa84dc9ec78e57b0350152e703be21c77b6b096ab39da4f96d9
- SSDEEP 3072:2Sr17uZrFB7YQOi0iqkXQtqZ7Lt8fx6TM36+SsYOI4MKFo4AnhKxQwIaZo//DVHo:25rFBEc0iz5qSZxKG4AnhKxQqoRBSF
- TLSH T11A445C21E6D405FDE637C1B8CAB7DA47EB72B8464370D58F53A01C561E23960AF39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Suspicious use of NtSetInformationThreadHideFromDebugger