f8727f129162a4f97055f1bc6d575ce3c9cd07bd8c624ab5846637dbadd39a54

General

Target
刷隐藏.rar
Size 48.8MB
Sample260907-kfhtqafg86
SHA256 f8727f129162a4f97055f1bc6d575ce3c9cd07bd8c624ab5846637dbadd39a54
MD5 682195e901737baabb40fcab8b3d7da5
SHA1 9fe3ec9c9fa49cc4e68ebf9cec023934b3fe0e8c
SHA512 f65142563868e3d527b28b2c05f7d15d9a7191353d029dfa217da2eced2dd5123b6b4518dea1efa9070a6b2398e7c61315be89c4985f5a2ff74937f4da39eb74
SSDEEP 1572864:Dl1tV88wO3SwP/fkXjnfso9cAPcpVuXs1:DfrXwO3SwP/fkXjnU4pcTN
TLSH
T1F8B7330A1B4DCF541FB0B894752E3C43764C5926BCE06FC0E799869D3898D897B7A83B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  BMWAiCoder/BMWAiCoder5.0/BMWAiCoder/BMWAiCoder.exe
- Size 2.9MB
- SHA256 9fce1192f8b00281c7b92fc03d819f389d2cb8b5509fb1b104f1f8b3adfb2d3f
- MD5 bfe62d97f0c854031824c7e8eaa3ff06
- SHA1 9d57b6963edb1b85f1231b1ddb0c454d19be44e9
- SHA512 998567dcc50ba7e892ff45f1b9be37754c8c6d1d4511aa6368a951188704304502d3ac24c765c021e95940d3c99cec8f9d8c08ded476e37a35046bccfe7d2683
- SSDEEP 49152:e/ZJAUUiIfRUMkufsfluD1Ckn4Nvff1AcEhAPnNjXzjCooWl7bVCtA:mTAAkauUfluDf8Kkzu87bV
- TLSH
  T183E53330769C34D4FC5B94B23DC2A26D662DFD11B92B1A3231AD31AD523BB910ED746C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion discovery persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  BMWAiCoder/BMWAiCoder5.0/BMWAiCoder/CIC.exe
- Size 35KB
- SHA256 3178841a2fded94e6469391e61ed3bc7de03053eee3540dc9e976583e34a7150
- MD5 9cabb500c8425d54416338ce06880ed5
- SHA1 185ac878de79dbe4840011d15e6de4422376d11e
- SHA512 bd911c4c53dfe104d2348ae30c8cd574a31a97b0d410a2fed257f102ca122831a738a9a100e0e01184b77d1d082e6f980f797f0cebd477b485f052c0ccd22538
- SSDEEP 768:5jRqyzHKb9BFT1mfgs6bbkTbzkqczgpXoUj1Ru+U0:5jRpGN1Js2bnqcspXp1z
- TLSH
  T1F5F23A4EE34B80F2E913453144AEE6BAA7B1FD548421CBEBFF483729E8337116D25159
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  BMWAiCoder/BMWAiCoder5.0/BMWAiCoder/NBT.exe
- Size 37KB
- SHA256 9b82746e78e334f8a59cf8b73200f41d791c476ca3cb50963234fc7802efc593
- MD5 00e4a056a5ba80276845b96692e4b121
- SHA1 435eb09d2c6b9055b83003111bb24b722d27f27b
- SHA512 8968f261a39db3701785691947d88e733a4e73d0d15f760db29157bb8f8d7439b1dc12e72ce9e363b7ff9c350146f1d6dd4f724ce534bb303dc266b642b97716
- SSDEEP 768:zPaKzy2JmNF4hBF2r1yy6vO/vHygd/VCHPTrP74EfyOp49oBgym:+Iy2Kigr1yGviPTrz4Ef/p49oBg
- TLSH
  T14D03F1C93DD23937CF2B08B208592DA7E3775520442ED65027986B1F36A2AFA3DD1D68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  BMWAiCoder/BMWAiCoder5.0/BMWAiCoder/Upgrade.exe
- Size 40KB
- SHA256 a37687ccacbdc09e816ad13425583c84b404a0506d8902b5d59c3f21bff5ab9d
- MD5 b237c84a0f61284e9084fb2164688315
- SHA1 d64de6e950b726d79e88b9da3b799a31ccd1a301
- SHA512 e5a80ab3d8b5f7eb0775c4e9f87b38da8612720609af7850da2b0d4e3d10921039da6ca2acbb18e34b1f824102effa044ce959fd3629e8f55e1ee5745cb7d83c
- SSDEEP 768:5p8N+w89E5tzzUkym26JWU9aQM0My5GsNnMu4Ltyr4aX6Ayb8x:5QO0Fy5GkQMlsRnyIx
- TLSH
  T1E4038D13B6D24036ED22CABC1C34B119BBBF3D301EA65979A77408CD6DA67806968377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion discovery persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  BMWAiCoder/BMWAiCoder5.0/BMWAiCoder/zint.dll
- Size 768KB
- SHA256 238fac4512ab8b0870a72a995eac9f0cc378f824429cd76f940f90c293342567
- MD5 f0c18be789b6040eeab600afdd200753
- SHA1 33d255c9225bc7be94e0c094d8137d0626059579
- SHA512 139a34e848c8f9041995b757c46a1569594c4c7813e2076cc6420be6937a4fa4007b3cc0e02e8c2019bd3a3f31cc185ea4c086f14466f885529f9987820bf0e5
- SSDEEP 12288:0R6jhUCTMbyUTWvzEGeRs41YBsD73nVkAk:0uhUCLUTWOnAo3Vj
- TLSH
  T16EF46A05BFA1AA22C9C6C3B4526BEF4D1F68D158D27227E7E7804BC01C097937D1E6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5