0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59

General

Target
Client.exe
Size 9.2MB
Sample261110-xpcqaacz4w
SHA256 0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59
MD5 9d2413ec3c83dead047a40b1430cca98
SHA1 79ac0ae265437b554b4aaaadb66c1fa738cf8702
SHA512 c5757b61d50eb736e43b459c715c5cee078dcfab32d1f1e4c2c5b1720e53600f7b2609e2c25b5b235a9c8cc60c8193d79486cf0b53e25ed913e31efd1f40de6a
SSDEEP 196608:NFjcCiso0nuzjGbYjdp2xghHZgbcIp5BgZZGlV31UVIfyV0d6S9:NFjcfsYRp2xgh5gnMZGlV3WN0H
TLSH
T17BA612134B4E325B134AF711AC90D4F8AC4D36866AC431F6A453E31DDC262D6E6B8DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Client.exe
- Size 9.2MB
- SHA256 0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59
- MD5 9d2413ec3c83dead047a40b1430cca98
- SHA1 79ac0ae265437b554b4aaaadb66c1fa738cf8702
- SHA512 c5757b61d50eb736e43b459c715c5cee078dcfab32d1f1e4c2c5b1720e53600f7b2609e2c25b5b235a9c8cc60c8193d79486cf0b53e25ed913e31efd1f40de6a
- SSDEEP 196608:NFjcCiso0nuzjGbYjdp2xghHZgbcIp5BgZZGlV31UVIfyV0d6S9:NFjcfsYRp2xgh5gnMZGlV3WN0H
- TLSH
  T17BA612134B4E325B134AF711AC90D4F8AC4D36866AC431F6A453E31DDC262D6E6B8DEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence adware ransomware spyware
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2