General
- Target implant.exe
- Size 406KB
- Sample260823-wmn5vsaj4y
- SHA256 5f8192a687e88ba003903a9d38e733f514d61482dff8d284f10ecaa60c6bd120
Score
9/10
Malware Config
Targets
-
- Target implant.exe
- Size 406KB
- SHA256 5f8192a687e88ba003903a9d38e733f514d61482dff8d284f10ecaa60c6bd120
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger