3230e49dc7cb36a3c3d58741c533fd3728ea03711caadba694bfcbeef84b1d84 | Triage

Sharing

General

Target

3230e49dc7cb36a3c3d58741c533fd3728ea03711caadba694bfcbeef84b1d84
Size

463KB
Sample

221003-btrjcaaeg4
MD5

6cf43436bafedf00db4072069a1c0670
SHA1

c05aa1fd10aa994a126b1b561d15a8150a5fdcb9
SHA256

3230e49dc7cb36a3c3d58741c533fd3728ea03711caadba694bfcbeef84b1d84
SHA512

9f5a536cfea976ea2c35717b50a75e1201a23cc45606b9b44520dfb6138af8ab54710c27eecb4c1d57b5e0d09dc41c5a0e96b19ac97938627727e1f1d87ffd25
SSDEEP

12288:NkQDI/lAVmFLnyPSu+MolufzyAlqcAi1ep:Nk8ItAwn6Su+Flkl71g

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  3230e49dc7cb36a3c3d58741c533fd3728ea03711caadba694bfcbeef84b1d84
- Size
  
  463KB
- MD5
  
  6cf43436bafedf00db4072069a1c0670
- SHA1
  
  c05aa1fd10aa994a126b1b561d15a8150a5fdcb9
- SHA256
  
  3230e49dc7cb36a3c3d58741c533fd3728ea03711caadba694bfcbeef84b1d84
- SHA512
  
  9f5a536cfea976ea2c35717b50a75e1201a23cc45606b9b44520dfb6138af8ab54710c27eecb4c1d57b5e0d09dc41c5a0e96b19ac97938627727e1f1d87ffd25
- SSDEEP
  
  12288:NkQDI/lAVmFLnyPSu+MolufzyAlqcAi1ep:Nk8ItAwn6Su+Flkl71g
Score

9^/10

evasion trojan
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2