General
- Target Installer.iso
- Size 18.9MB
- Sample260910-lml1dst1bx
- SHA256 c489ffa503624d6de25bed8ea8b340c6f9caa239010b47bb4e433c4dc360b30c
Score
10/10
Malware Config
Targets
-
- Target Installer_v3931_x64_.exe
- Size 18.8MB
- SHA256 3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c
Score10/10Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Executes dropped EXE
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks whether UAC is enabled
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1