2c2448c4194da2bbec0e515bdae97388d02c2f605faf6520d2c0db5a1d11d213 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c2448c4194da2bbec0e515bdae97388d02c2f605faf6520d2c0db5a1d11d213
Size

1.8MB
Sample

221001-devnkagdbr
MD5

7ea2fc5efe15be5bb4f42b7285e3bd72
SHA1

0b220b8ec2f5c72d503466da92394dfbafb7223e
SHA256

2c2448c4194da2bbec0e515bdae97388d02c2f605faf6520d2c0db5a1d11d213
SHA512

f288472b36e52aac018b38241c41fb8f0d10301a05dafd3a5ec596160b4a0fcb66204f2441ee35ce966a6d79305638f3c401d0eeacd105829aafacdd2b1fecc8
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  2c2448c4194da2bbec0e515bdae97388d02c2f605faf6520d2c0db5a1d11d213
- Size
  
  1.8MB
- MD5
  
  7ea2fc5efe15be5bb4f42b7285e3bd72
- SHA1
  
  0b220b8ec2f5c72d503466da92394dfbafb7223e
- SHA256
  
  2c2448c4194da2bbec0e515bdae97388d02c2f605faf6520d2c0db5a1d11d213
- SHA512
  
  f288472b36e52aac018b38241c41fb8f0d10301a05dafd3a5ec596160b4a0fcb66204f2441ee35ce966a6d79305638f3c401d0eeacd105829aafacdd2b1fecc8
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1