281a1cfaebf968012e9596721d14b1bd6429744617e73f96558cb68bcc0db8f8

Resubmissions

12/05/2022, 21:09

220512-zzeczaabg49

10/05/2022, 12:16

220510-pfl9csbefm10

09/05/2022, 23:26

220509-3e4nxaedh710

Sharing

Copy URL Twitter E-mail

General

Target
oblot.dll
Size 1.3MB
Sample220512-zzeczaabg4
SHA256 281a1cfaebf968012e9596721d14b1bd6429744617e73f96558cb68bcc0db8f8
MD5 38ea4397f1c9dfe79e9accaebe7487ec
SHA1 24614b49e47bbdc30263cc86cea8aceb2781f1ed
SHA512 3b8d8deb404a52cb43306c8b3275f61efd8092202cf5ac5d86c342664b1673080abb3689f77b5bcc94b88ca10f238eb2dba67161619588e443ca6e04e261399b
MD5 SHA1 SHA512

Score

9^/10

evasion

Malware Config

Targets

- Target
  oblot.dll
- Size 1.3MB
- SHA256 281a1cfaebf968012e9596721d14b1bd6429744617e73f96558cb68bcc0db8f8
- MD5 38ea4397f1c9dfe79e9accaebe7487ec
- SHA1 24614b49e47bbdc30263cc86cea8aceb2781f1ed
- SHA512 3b8d8deb404a52cb43306c8b3275f61efd8092202cf5ac5d86c342664b1673080abb3689f77b5bcc94b88ca10f238eb2dba67161619588e443ca6e04e261399b
- MD5 SHA1 SHA512
Score

9^/10

evasion
- Enumerates VirtualBox registry keys
  evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Checks BIOS information in registry

Identifies Wine through registry keys

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2