95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219
Size

623KB
Sample

221011-h1a89sbdf9
MD5

6f293276b9906b422e25cf024739d3f0
SHA1

5b8e3915ce7660eb619120a59ea11ae34643117c
SHA256

95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219
SHA512

169e754fab58f4ee382dba149d7f73534f315f217b809770f54d14e259bbaa5510bd74bb663bbdf79ae9913b2b01b5dbc0a11fbf21ff2f231b97137726e2c474
SSDEEP

12288:GY0Sv/v6GZfilQoDq99rltN3tPckKADsdtp59WbhI8T1RlvKF:G0/v6GZfi2o299JT3tPuADsd7GI8jlvc

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219
- Size
  
  623KB
- MD5
  
  6f293276b9906b422e25cf024739d3f0
- SHA1
  
  5b8e3915ce7660eb619120a59ea11ae34643117c
- SHA256
  
  95aa6b314198428580f943740fa11c5b860b7567f0c2f08d2d3e690a995a7219
- SHA512
  
  169e754fab58f4ee382dba149d7f73534f315f217b809770f54d14e259bbaa5510bd74bb663bbdf79ae9913b2b01b5dbc0a11fbf21ff2f231b97137726e2c474
- SSDEEP
  
  12288:GY0Sv/v6GZfilQoDq99rltN3tPckKADsdtp59WbhI8T1RlvKF:G0/v6GZfi2o299JT3tPuADsd7GI8jlvc
Score

9^/10

evasion persistence
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence