General
- Target ZyroxBoost.exe
- Size 51.3MB
- Sample261027-2t9m2aef62
- SHA256 92462af4698bacf65795906805dccae4faeeb710bf284c6f33abbb5fb72f069b
Score
8/10
Malware Config
Targets
-
- Target ZyroxBoost.exe
- Size 51.3MB
- SHA256 92462af4698bacf65795906805dccae4faeeb710bf284c6f33abbb5fb72f069b
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Share Discovery
Attempt to gather information on host network.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Suspicious use of NtSetInformationThreadHideFromDebugger