a5ab400e5f2bf583acdf409e25ec436752385f3ff9ed5953302ef3f0a0b5c5b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5ab400e5f2bf583acdf409e25ec436752385f3ff9ed5953302ef3f0a0b5c5b7
Size

1.8MB
Sample

220920-eqzx4afeaq
MD5

244d9c001434b59168d51d2349a87d1a
SHA1

a5baff220adddb98da11715830fea41e729c87bf
SHA256

a5ab400e5f2bf583acdf409e25ec436752385f3ff9ed5953302ef3f0a0b5c5b7
SHA512

a466b39d1ec75cad12f1eef7ce65f8041eb3febae05a08a73d53b113cdcc54a6a951c4975164bb13c6d2b0fbcdd91c972c129c9b2ea67d3a2adc459b23506c35
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  a5ab400e5f2bf583acdf409e25ec436752385f3ff9ed5953302ef3f0a0b5c5b7
- Size
  
  1.8MB
- MD5
  
  244d9c001434b59168d51d2349a87d1a
- SHA1
  
  a5baff220adddb98da11715830fea41e729c87bf
- SHA256
  
  a5ab400e5f2bf583acdf409e25ec436752385f3ff9ed5953302ef3f0a0b5c5b7
- SHA512
  
  a466b39d1ec75cad12f1eef7ce65f8041eb3febae05a08a73d53b113cdcc54a6a951c4975164bb13c6d2b0fbcdd91c972c129c9b2ea67d3a2adc459b23506c35
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1