Overview

overview

9

Static

static

payment Slip.exe

windows7_x64

9

payment Slip.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment Slip.exe

  • Size

    824KB

  • Sample

    200716-t7hysepg6x

  • MD5

    f2dc2472943a80a1adb493cefc36235a

  • SHA1

    0288a2c724051d6f42784b84dbb5cae170144358

  • SHA256

    6d64f2c47bc182a160e02ceebb8e194dd627fb83d762f9d1609d4f1d7cf3ff89

  • SHA512

    9ed2ee019ad571e2fe601bb78d5a4f6228734c551db00dafe2eb6752fdf20970b24306a2b60579c2bb4e63b519a4893d1ea4500bb93e42789eda045e067e02a4

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      payment Slip.exe

    • Size

      824KB

    • MD5

      f2dc2472943a80a1adb493cefc36235a

    • SHA1

      0288a2c724051d6f42784b84dbb5cae170144358

    • SHA256

      6d64f2c47bc182a160e02ceebb8e194dd627fb83d762f9d1609d4f1d7cf3ff89

    • SHA512

      9ed2ee019ad571e2fe601bb78d5a4f6228734c551db00dafe2eb6752fdf20970b24306a2b60579c2bb4e63b519a4893d1ea4500bb93e42789eda045e067e02a4

    Score
    9/10
    evasionpersistence

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks