7d913f06c252acee7495e34f57c13938adc5c6a93386baaabd6fc758a1cd90de | Triage

Sharing

General

Target

7d913f06c252acee7495e34f57c13938adc5c6a93386baaabd6fc758a1cd90de
Size

2.7MB
Sample

220921-mdqgwsbfej
MD5

bc04ac2e5e98d038456e29fa1c9ab0b0
SHA1

364cbb5f08a5515d54fe4b095f08cd76c28c8ee9
SHA256

7d913f06c252acee7495e34f57c13938adc5c6a93386baaabd6fc758a1cd90de
SHA512

8fbac3733659c2ebcfe9cc7dd28d70146c1797da72b5dd9ff381c29867626fe5447ce9371642cde2fe3256ff2a73c50d0a93ac572ac28380396d0e4a99732973
SSDEEP

49152:agMMY7tPwuIBfzFo2gFhs4Cv2b7CsXgg/nvCjXKquGy4X5lSFg6pvAAJ7kt:nMM+tPwPBmts4tfgKqjX1dJUpvAAJ7kt

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  7d913f06c252acee7495e34f57c13938adc5c6a93386baaabd6fc758a1cd90de
- Size
  
  2.7MB
- MD5
  
  bc04ac2e5e98d038456e29fa1c9ab0b0
- SHA1
  
  364cbb5f08a5515d54fe4b095f08cd76c28c8ee9
- SHA256
  
  7d913f06c252acee7495e34f57c13938adc5c6a93386baaabd6fc758a1cd90de
- SHA512
  
  8fbac3733659c2ebcfe9cc7dd28d70146c1797da72b5dd9ff381c29867626fe5447ce9371642cde2fe3256ff2a73c50d0a93ac572ac28380396d0e4a99732973
- SSDEEP
  
  49152:agMMY7tPwuIBfzFo2gFhs4Cv2b7CsXgg/nvCjXKquGy4X5lSFg6pvAAJ7kt:nMM+tPwPBmts4tfgKqjX1dJUpvAAJ7kt
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2