03e0491d1e10eb09d68e7420f3ebd8a3da94f3162fa9ac170123773b178d7aff | Triage

Sharing

General

Target

strings-tool.exe
Size

13.8MB
Sample

221027-1frpmadgbq
MD5

74100383d20ec7187e798f805a61a55b
SHA1

37e8e7064c24572c0144a653c0db090dc0abbcdc
SHA256

03e0491d1e10eb09d68e7420f3ebd8a3da94f3162fa9ac170123773b178d7aff
SHA512

e0bcd986ca0b4b4d9f002822a9138877add0d355552d752d26ec49ab89e638b77fa3f9078c13fe14aafc5f0fa58c14510f38a6dab72e9e2e30df5445001bb0f7
SSDEEP

98304:GRtrixXh0fPq/oXcr6pdJq6r0R9zzckmfLUyFtHmaspWGNhbuV3Vrxrp42TZqrz+:GqxxAtBAehbh6KQ58Yy6mQdICXTvk

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  strings-tool.exe
- Size
  
  13.8MB
- MD5
  
  74100383d20ec7187e798f805a61a55b
- SHA1
  
  37e8e7064c24572c0144a653c0db090dc0abbcdc
- SHA256
  
  03e0491d1e10eb09d68e7420f3ebd8a3da94f3162fa9ac170123773b178d7aff
- SHA512
  
  e0bcd986ca0b4b4d9f002822a9138877add0d355552d752d26ec49ab89e638b77fa3f9078c13fe14aafc5f0fa58c14510f38a6dab72e9e2e30df5445001bb0f7
- SSDEEP
  
  98304:GRtrixXh0fPq/oXcr6pdJq6r0R9zzckmfLUyFtHmaspWGNhbuV3Vrxrp42TZqrz+:GqxxAtBAehbh6KQ58Yy6mQdICXTvk
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Impair Defenses

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2