Overview

overview

7

Static

static

ed3cc6263d...1f.exe

windows7_x64

7

ed3cc6263d...1f.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f

  • Size

    2.1MB

  • Sample

    210513-hzkbbxbjqn

  • MD5

    583cabc27c03b2be3095678112891d5e

  • SHA1

    89800d941b3fd9ed51ddb92ebb4e745e47385c73

  • SHA256

    ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f

  • SHA512

    49bcd0f6bd56592844f7dc4f0d6db66cdb477a99a7dce530a6a272b25aeb735393e1e4a974b03df72d773af1dabd2d50cee361e485e9ab3d9eaf8854123b76a4

Score
7/10
evasion

Malware Config

Targets

    • Target

      ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f

    • Size

      2.1MB

    • MD5

      583cabc27c03b2be3095678112891d5e

    • SHA1

      89800d941b3fd9ed51ddb92ebb4e745e47385c73

    • SHA256

      ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f

    • SHA512

      49bcd0f6bd56592844f7dc4f0d6db66cdb477a99a7dce530a6a272b25aeb735393e1e4a974b03df72d773af1dabd2d50cee361e485e9ab3d9eaf8854123b76a4

    Score
    7/10
    evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks