8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6

General

Target
emulator (1).exe
Size 5.7MB
Sample261022-thdgfsssax
SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
MD5 386e849fce83bb83a2d6782af0f09422
SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
TLSH
T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  emulator (1).exe
- Size 5.7MB
- SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
- MD5 386e849fce83bb83a2d6782af0f09422
- SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
- SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
- SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
- TLSH
  T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1