b998f0766ec04790f4843843b689060e108efada67b3786a05c47b3da6e82fab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b998f0766ec04790f4843843b689060e108efada67b3786a05c47b3da6e82fab
Size

1.8MB
Sample

220916-ljasysfcb4
MD5

62d9fa83101df1148d6cbd7599a0aa05
SHA1

e7410044eac864302309a910f417e2fdbe125ea8
SHA256

b998f0766ec04790f4843843b689060e108efada67b3786a05c47b3da6e82fab
SHA512

2d2604d6798e707a0063e19f276e94ebadc6ecee7704ee938fe76637e59dc589e53fff82665a6711d253aa4f6ff8763296dc4c98cdb4d14dc0fbd627713bd0ff
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  b998f0766ec04790f4843843b689060e108efada67b3786a05c47b3da6e82fab
- Size
  
  1.8MB
- MD5
  
  62d9fa83101df1148d6cbd7599a0aa05
- SHA1
  
  e7410044eac864302309a910f417e2fdbe125ea8
- SHA256
  
  b998f0766ec04790f4843843b689060e108efada67b3786a05c47b3da6e82fab
- SHA512
  
  2d2604d6798e707a0063e19f276e94ebadc6ecee7704ee938fe76637e59dc589e53fff82665a6711d253aa4f6ff8763296dc4c98cdb4d14dc0fbd627713bd0ff
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1