General
- Target data0.bin.exe
- Size 229.5MB
- Sample261002-pdgwvs1apb
- SHA256 a3cb7d8e7c3762812676da664d7fb1203355e28e48206ef83ffacd3392e14580
Score
9/10
Malware Config
Targets
-
- Target data0.bin.exe
- Size 229.5MB
- SHA256 a3cb7d8e7c3762812676da664d7fb1203355e28e48206ef83ffacd3392e14580
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Modifies file permissions
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1