Overview

overview

9

Static

static

d79f12fa46...18.exe

windows7-x64

9

d79f12fa46...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    d79f12fa46ae84f648cd492b46a38138d0d432d6002781595061707b9c09b018

  • Size

    824KB

  • Sample

    221030-n4sklsafcr

  • MD5

    93559b1f73f9d9aecca596e4eb034e70

  • SHA1

    2b1e659c547f23223e31a4ce96023276405dcc8a

  • SHA256

    d79f12fa46ae84f648cd492b46a38138d0d432d6002781595061707b9c09b018

  • SHA512

    a1fca5eecbab0a6e2939a60fe045457c78478b21c6f2b2ce82eb816a8f1f4f495fd384527ee15a978cbd471783747664e007c88cb89d7ccfaee434531adbe64e

  • SSDEEP

    24576:QZJ+3Rbxv7mctSdkeXofT/+brY2Qwz+Rq7ISop:Go5xv7mcseeXr0IsS2

Score
9/10
evasion

Malware Config

Targets

    • Target

      d79f12fa46ae84f648cd492b46a38138d0d432d6002781595061707b9c09b018

    • Size

      824KB

    • MD5

      93559b1f73f9d9aecca596e4eb034e70

    • SHA1

      2b1e659c547f23223e31a4ce96023276405dcc8a

    • SHA256

      d79f12fa46ae84f648cd492b46a38138d0d432d6002781595061707b9c09b018

    • SHA512

      a1fca5eecbab0a6e2939a60fe045457c78478b21c6f2b2ce82eb816a8f1f4f495fd384527ee15a978cbd471783747664e007c88cb89d7ccfaee434531adbe64e

    • SSDEEP

      24576:QZJ+3Rbxv7mctSdkeXofT/+brY2Qwz+Rq7ISop:Go5xv7mcseeXr0IsS2

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks