General
-
Target
nyx 2.0.zip
-
Size
5.4MB
-
Sample
240630-k5w3msvhqf
-
MD5
66f99ee31c06338b56f54daade5b11d0
-
SHA1
499dad7369984f19de95395ab223a7e197a3b9a0
-
SHA256
0c31c6a241a8b45dbe172328800aad3e89145073b6f49e02dc3105cb4dcfd6d6
-
SHA512
a71feb56e525c4e2f6377d4f3c00d712fa4e80773a36888d6231c449c7ef2769a9a392032064ec2f3580fe33f80c821ca6cb30be89a4990470b7a5aaab5d2752
-
SSDEEP
98304:f8zPw4/iD45FrZcV3KJ0M9LiOMa9Wr8LKVowjq0b9v/J+VHwQMTO+MA6cBmbpj:f8zPw4i45NZckn9HWQLv0bJuuX9i
Behavioral task
behavioral1
Sample
Release/Nyx.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
Release/Nyx.exe
-
Size
3.5MB
-
MD5
00ec60cd1add4a2f61e48c7b0a6c810f
-
SHA1
174af7f09725d67d522e65066d3e3662da50a4e2
-
SHA256
df4da6874570d3e753519898684bbad60378725d24f9557f5d5294fcfd795a29
-
SHA512
244afaa72bea7b46633dbaf79bdac388dfaf190e88d3a7675d16b36cfaeb39e9b47f1dc6ac1ddc059c64e091dfff562460ac83f9e669e42c3f90ac9fc44c1003
-
SSDEEP
98304:zcwncs4fUCBRTna03MfhwbIZosECIMRvl:Ywnc3HdahZ4IgCr
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-