6902c8b87d2acfec02553929218612c8aa1916313098e641362d8f689bf27e3b | Triage

Sharing

General

Target

6902c8b87d2acfec02553929218612c8aa1916313098e641362d8f689bf27e3b
Size

1.8MB
Sample

220914-zlb1pabcc3
MD5

9643795fcb0fa7a609d7b0f1ae2b7c8b
SHA1

a142b0ae893e624e10abb03962a1179525b42c2b
SHA256

6902c8b87d2acfec02553929218612c8aa1916313098e641362d8f689bf27e3b
SHA512

b9951e9ebbf14688284768c0e10bf982aa1465a7c98284a50318f59b1ff8620227eb05475aafe139751a3a83f6bc807bdd2695811bbe06395b12af5a66ef89ef
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  6902c8b87d2acfec02553929218612c8aa1916313098e641362d8f689bf27e3b
- Size
  
  1.8MB
- MD5
  
  9643795fcb0fa7a609d7b0f1ae2b7c8b
- SHA1
  
  a142b0ae893e624e10abb03962a1179525b42c2b
- SHA256
  
  6902c8b87d2acfec02553929218612c8aa1916313098e641362d8f689bf27e3b
- SHA512
  
  b9951e9ebbf14688284768c0e10bf982aa1465a7c98284a50318f59b1ff8620227eb05475aafe139751a3a83f6bc807bdd2695811bbe06395b12af5a66ef89ef
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1