General
- Target dist.rar
- Size 5.4MB
- Sample261002-tc6wtade79
- SHA256 7d11a92f3ba0ec31e914c4ea1eeb1f5170f64ff16e203c047e506cbfeada3150
Score
9/10
Malware Config
Targets
-
- Target WebView2Loader.dll
- Size 161KB
- SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
Score1/10 -
- Target libcrypto-4-x64.dll
- Size 4.6MB
- SHA256 5527ff18dd749687d886ef7f383463b6ce7bca66c773d6ff94f40190da853ebe
Score1/10 -
- Target libssl-4-x64.dll
- Size 1.5MB
- SHA256 d4ef34a4634fdf5c3b906db860f92165f2ac5ccc5d22a9f0057452fd983c2a9c
Score1/10 -
- Target sx_client_protected.exe
- Size 3.6MB
- SHA256 396bb9a3731ef8939c16becf3969249178ad90f6cc12b414cc406d5abc0c55c8
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1