47483d0595f7eb01236b2d68240d80a0712368e0ebbebad938f744546c5a989c | Triage

Sharing

General

Target

47483d0595f7eb01236b2d68240d80a0712368e0ebbebad938f744546c5a989c
Size

1.8MB
Sample

220929-r7ckcacbdr
MD5

e27dbc7153904f186e97799eee0c28df
SHA1

cd196da7b28c5d3aa921c461c892d9505bdaf31e
SHA256

47483d0595f7eb01236b2d68240d80a0712368e0ebbebad938f744546c5a989c
SHA512

778159eba87f446a6eb48faeaf02b08d9d8516d5baf5dd022b8f2705c4e444ff6e53a1b7c5a30df64a93e2738ef86a02e087628932d9b3892c1ac21a6d2111b7
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  47483d0595f7eb01236b2d68240d80a0712368e0ebbebad938f744546c5a989c
- Size
  
  1.8MB
- MD5
  
  e27dbc7153904f186e97799eee0c28df
- SHA1
  
  cd196da7b28c5d3aa921c461c892d9505bdaf31e
- SHA256
  
  47483d0595f7eb01236b2d68240d80a0712368e0ebbebad938f744546c5a989c
- SHA512
  
  778159eba87f446a6eb48faeaf02b08d9d8516d5baf5dd022b8f2705c4e444ff6e53a1b7c5a30df64a93e2738ef86a02e087628932d9b3892c1ac21a6d2111b7
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1