General

  • Target

    a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f

  • Size

    2.4MB

  • Sample

    220521-x37gtacha9

  • MD5

    5bf9b9d44414ca71dfd7159b00cbc8d6

  • SHA1

    7bee238bbf995a118c1cd22299cfab8732d71eb2

  • SHA256

    a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f

  • SHA512

    2ac034181a8be1d28d5fdcda6ac60ca2f51bb8a477f294804800fec5d54633064e5fa0be7ad82cec27164242ba5f6aafaa15ac8336d9054af88ec2186ea3f6a2

Malware Config

Targets

    • Target

      a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f

    • Size

      2.4MB

    • MD5

      5bf9b9d44414ca71dfd7159b00cbc8d6

    • SHA1

      7bee238bbf995a118c1cd22299cfab8732d71eb2

    • SHA256

      a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f

    • SHA512

      2ac034181a8be1d28d5fdcda6ac60ca2f51bb8a477f294804800fec5d54633064e5fa0be7ad82cec27164242ba5f6aafaa15ac8336d9054af88ec2186ea3f6a2

    Score
    9/10
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Tasks