94f8936a3a44937cde82b1a5c747e939df9719c75f83152c1fe1afdebc6fd567 | Triage

Sharing

General

Target

94f8936a3a44937cde82b1a5c747e939df9719c75f83152c1fe1afdebc6fd567
Size

727KB
Sample

221003-rctv5sacfr
MD5

685d72a0ff259bc1df1ae7c1d4242bb7
SHA1

94dd364612a5e85f8fc197f11cf9b572bc4db01c
SHA256

94f8936a3a44937cde82b1a5c747e939df9719c75f83152c1fe1afdebc6fd567
SHA512

694cfb9a10b0b54147d0f5eae48a7083806fa7f7aaa42e73a4c3dcf7463545d952edb3db2a07947f806b5c3c94cb1f4eccb77208dc0db8d8d136898414fae03d
SSDEEP

12288:obxWvm991+6So2v+xlobKgN4vd/4vPZLNuTntnDDYeRxWpvqKnZAxk:olWvz6So2mLgKgN4vd/2ZkTBDMeapSi

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  94f8936a3a44937cde82b1a5c747e939df9719c75f83152c1fe1afdebc6fd567
- Size
  
  727KB
- MD5
  
  685d72a0ff259bc1df1ae7c1d4242bb7
- SHA1
  
  94dd364612a5e85f8fc197f11cf9b572bc4db01c
- SHA256
  
  94f8936a3a44937cde82b1a5c747e939df9719c75f83152c1fe1afdebc6fd567
- SHA512
  
  694cfb9a10b0b54147d0f5eae48a7083806fa7f7aaa42e73a4c3dcf7463545d952edb3db2a07947f806b5c3c94cb1f4eccb77208dc0db8d8d136898414fae03d
- SSDEEP
  
  12288:obxWvm991+6So2v+xlobKgN4vd/4vPZLNuTntnDDYeRxWpvqKnZAxk:olWvz6So2mLgKgN4vd/2ZkTBDMeapSi
Score

9^/10

evasion persistence
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence