General
- Target perm files (w-o spoofer driver).zip
- Size 9.3MB
- Sample260818-s5tlhsvflh
- SHA256 56d72e476202ef0d40e560d004368f2cfb428a4de15bf457a13a92f2ff485204
Score
9/10
Malware Config
Targets
-
- Target Sawaf_1.exe
- Size 365KB
- SHA256 715eb7d445114e944ec249f98ae4c1d7e324e59fc1f06fb1105206b7cbf4eee8
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target sawaf.exe
- Size 3.7MB
- SHA256 7c6057273903aa7e9b998a36d14cf9a15be175dd0863a3509cf87dafbc4c876b
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target winxsrcsv64.exe
- Size 377KB
- SHA256 5e66ba6e5dc98c65fb5d6a0c4bef4a090aad01386ef44643c416b613bdb70a38
Score1/10 -
- Target z.exe
- Size 5.2MB
- SHA256 2bbd482267c97d49be95314057b56415d784d69aedcd9947b0124fb1f81baf93
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger