Overview

overview

9

Static

static

410eac5d77...36.exe

windows7_x64

9

410eac5d77...36.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36

  • Size

    8.9MB

  • Sample

    220521-mjktlabgg8

  • MD5

    46168b6bae327a9d6aa590fbd5a9688a

  • SHA1

    b14ef01b29545966e801c3f8b55fb733fbf5f63b

  • SHA256

    410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36

  • SHA512

    12f375f2259161e0eb1c8b79dedac7369b428ca2d7fb610e8a839db490c5640ceb98751b248d506607895174a8a9a82ecb0656a703ad82c7c6f3610a3cfa28f8

Score
9/10
evasionupxvmprotect

Malware Config

Targets

    • Target

      410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36

    • Size

      8.9MB

    • MD5

      46168b6bae327a9d6aa590fbd5a9688a

    • SHA1

      b14ef01b29545966e801c3f8b55fb733fbf5f63b

    • SHA256

      410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36

    • SHA512

      12f375f2259161e0eb1c8b79dedac7369b428ca2d7fb610e8a839db490c5640ceb98751b248d506607895174a8a9a82ecb0656a703ad82c7c6f3610a3cfa28f8

    Score
    9/10
    evasionupxvmprotect

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks