4f383ba16164b64ee24551e57272e00f3790676c5fb8ac77b4efb8505e267d12 | Triage

Sharing

General

Target

4f383ba16164b64ee24551e57272e00f3790676c5fb8ac77b4efb8505e267d12
Size

1.8MB
Sample

221005-t4ayfsehc3
MD5

31635a5fd0069116dab027ce4655575f
SHA1

38d25edda95e848956a7f7ad10861bd6eb7e9c84
SHA256

4f383ba16164b64ee24551e57272e00f3790676c5fb8ac77b4efb8505e267d12
SHA512

7065bcbe101def0c2b5b13c75d38a27e8a335923195cf1d5d917fe5a06121fe2f761136e9373a3a49fc81b27487c19a3498b13d20759ec78c856d3c94cef34ee
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  4f383ba16164b64ee24551e57272e00f3790676c5fb8ac77b4efb8505e267d12
- Size
  
  1.8MB
- MD5
  
  31635a5fd0069116dab027ce4655575f
- SHA1
  
  38d25edda95e848956a7f7ad10861bd6eb7e9c84
- SHA256
  
  4f383ba16164b64ee24551e57272e00f3790676c5fb8ac77b4efb8505e267d12
- SHA512
  
  7065bcbe101def0c2b5b13c75d38a27e8a335923195cf1d5d917fe5a06121fe2f761136e9373a3a49fc81b27487c19a3498b13d20759ec78c856d3c94cef34ee
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1