General
Target

e741ba051fa60462cac39be6fe4b2f410717648da7c057fab5493eb89465917a

Size

2MB

Sample

220520-fwl4vseben

Score
9/10
MD5

12beea0d938081923ae7d4a518e92529

SHA1

26bf7680167e2d3b5487a097929db81152972738

SHA256

e741ba051fa60462cac39be6fe4b2f410717648da7c057fab5493eb89465917a

SHA512

7da7486502f198be1793d59b6d922d1ee6402b49e9069404a7681e274708c0a0e44656edfa3f9961c8d93c3fd146ad03327056152dc016e8b700df135d4257e4

Malware Config
Targets
Target

e741ba051fa60462cac39be6fe4b2f410717648da7c057fab5493eb89465917a

MD5

12beea0d938081923ae7d4a518e92529

Filesize

2MB

Score
9/10
SHA1

26bf7680167e2d3b5487a097929db81152972738

SHA256

e741ba051fa60462cac39be6fe4b2f410717648da7c057fab5493eb89465917a

SHA512

7da7486502f198be1793d59b6d922d1ee6402b49e9069404a7681e274708c0a0e44656edfa3f9961c8d93c3fd146ad03327056152dc016e8b700df135d4257e4

Tags

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • Checks BIOS information in registry

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery
  • Identifies Wine through registry keys

    Description

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery
  • Writes to the Master Boot Record (MBR)

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    Tags

    TTPs

    Bootkit
  • Suspicious use of NtSetInformationThreadHideFromDebugger

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    9/10

                    behavioral2

                    Score
                    9/10