af2d30f8bfec1d130c393c0fb4c66af8fb2d23f821a9ea24755e9615af6cc843 | Triage

Sharing

General

Target

af2d30f8bfec1d130c393c0fb4c66af8fb2d23f821a9ea24755e9615af6cc843
Size

1.8MB
Sample

221005-1317ksgadq
MD5

9ab3225057a83adc0c9811eb8cf39563
SHA1

80721d06d9b8438a217c1f23bdeb790c6f729582
SHA256

af2d30f8bfec1d130c393c0fb4c66af8fb2d23f821a9ea24755e9615af6cc843
SHA512

c38c75f2df30c04d354a7dd9603b75db92dc34cd40d6fe7336f44d5d177f29f514cd8ceb4858c4363b2e777adb09cd7a8d4926cb1eabe328fe6485d62646efbf
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  af2d30f8bfec1d130c393c0fb4c66af8fb2d23f821a9ea24755e9615af6cc843
- Size
  
  1.8MB
- MD5
  
  9ab3225057a83adc0c9811eb8cf39563
- SHA1
  
  80721d06d9b8438a217c1f23bdeb790c6f729582
- SHA256
  
  af2d30f8bfec1d130c393c0fb4c66af8fb2d23f821a9ea24755e9615af6cc843
- SHA512
  
  c38c75f2df30c04d354a7dd9603b75db92dc34cd40d6fe7336f44d5d177f29f514cd8ceb4858c4363b2e777adb09cd7a8d4926cb1eabe328fe6485d62646efbf
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1