72a0c4c8fc483028db05c48c969ff0f5deada1614ee92cf15e66d451e003a879 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72a0c4c8fc483028db05c48c969ff0f5deada1614ee92cf15e66d451e003a879
Size

47KB
Sample

221027-ew9pgsaeh5
MD5

44cf7fed73a4e207409a80684cb0fe05
SHA1

ca0d81650753d4e442d825c8dff4d983241f2cf0
SHA256

72a0c4c8fc483028db05c48c969ff0f5deada1614ee92cf15e66d451e003a879
SHA512

5fc9db0a86679321a710a9f74f02209d9341c24ef9dd3fa235668423a58917b123c23eeda71915424847dcedf919a5f15889280b7b231273907d1e8559391b2c
SSDEEP

768:wCSZA9RTpThgdzpZg5+3D22XZ5Epnjiwlegjt0zV2MPouJctrO6:wCSZ+glj3zp5EpXXO52MA9O6

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  72a0c4c8fc483028db05c48c969ff0f5deada1614ee92cf15e66d451e003a879
- Size
  
  47KB
- MD5
  
  44cf7fed73a4e207409a80684cb0fe05
- SHA1
  
  ca0d81650753d4e442d825c8dff4d983241f2cf0
- SHA256
  
  72a0c4c8fc483028db05c48c969ff0f5deada1614ee92cf15e66d451e003a879
- SHA512
  
  5fc9db0a86679321a710a9f74f02209d9341c24ef9dd3fa235668423a58917b123c23eeda71915424847dcedf919a5f15889280b7b231273907d1e8559391b2c
- SSDEEP
  
  768:wCSZA9RTpThgdzpZg5+3D22XZ5Epnjiwlegjt0zV2MPouJctrO6:wCSZ+glj3zp5EpXXO52MA9O6
Score

9^/10

evasion persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence