Overview

overview

9

Static

static

506c00ed7a...32.exe

windows7_x64

9

506c00ed7a...32.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32

  • Size

    2.2MB

  • Sample

    220521-eqy1sscgal

  • MD5

    052c154a9921c3b73b0096dc384a1d06

  • SHA1

    cd342645b29d36cb6010c27f99a02727154e065c

  • SHA256

    506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32

  • SHA512

    a0e03522381b4a0c230bf2e5f535df9d5177d983dce16eaeb1e1b7401f7b9597e48965b92067e5cd3b2ac6fa9ab3d22ddefd2ccdc9528849885912bc9ef670e8

Score
9/10
evasion

Malware Config

Targets

    • Target

      506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32

    • Size

      2.2MB

    • MD5

      052c154a9921c3b73b0096dc384a1d06

    • SHA1

      cd342645b29d36cb6010c27f99a02727154e065c

    • SHA256

      506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32

    • SHA512

      a0e03522381b4a0c230bf2e5f535df9d5177d983dce16eaeb1e1b7401f7b9597e48965b92067e5cd3b2ac6fa9ab3d22ddefd2ccdc9528849885912bc9ef670e8

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks