General
- Target AntiRecoil_patched.exe
- Size 3.5MB
- Sample261030-12dd5afv2x
- SHA256 6ab03b2648804dfbad2bc4487eb71e36e859c1126268de961230f6eef417ea35
- MD5 f296b059fe57a43f246a8b2ae0458a4f
- SHA1 a54b327b5cc9af3c4660222f683e6368a94b7085
- SHA512 a8ff3eb039ee3645c056f7edc21ad1f62a8970ed99acfda96bab4d9f9bc0e5229df66863029339e56d2fbcde26c506852e627f8c3f4fff32adf07c65b362900b
- SSDEEP 98304:OT1bmGW3clyVEc1GbX6KgYIsB0SbRcxFiW:OT1hD5nKKZ0t2W
- TLSH T18FF5AE8366E840F6D866C275C5578A4FE7F278111B31E7CF41A0069E1FBB3A14DBA326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AntiRecoil_patched.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AntiRecoil_patched.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target AntiRecoil_patched.exe
- Size 3.5MB
- SHA256 6ab03b2648804dfbad2bc4487eb71e36e859c1126268de961230f6eef417ea35
- MD5 f296b059fe57a43f246a8b2ae0458a4f
- SHA1 a54b327b5cc9af3c4660222f683e6368a94b7085
- SHA512 a8ff3eb039ee3645c056f7edc21ad1f62a8970ed99acfda96bab4d9f9bc0e5229df66863029339e56d2fbcde26c506852e627f8c3f4fff32adf07c65b362900b
- SSDEEP 98304:OT1bmGW3clyVEc1GbX6KgYIsB0SbRcxFiW:OT1hD5nKKZ0t2W
- TLSH T18FF5AE8366E840F6D866C275C5578A4FE7F278111B31E7CF41A0069E1FBB3A14DBA326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VMWare services registry key.
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger