8a074fe4a891e4468fc41e1fd721cd1192013922e192708e5fd9d0bde51a63fe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a074fe4a891e4468fc41e1fd721cd1192013922e192708e5fd9d0bde51a63fe
Size

781KB
Sample

221031-bpflaahhc6
MD5

913068eac706d8b4a9fc5e50834f9410
SHA1

a3ad7fde1e53dd274e321cebbd676505c46ca094
SHA256

8a074fe4a891e4468fc41e1fd721cd1192013922e192708e5fd9d0bde51a63fe
SHA512

efaddc6916e996c72ebc27afd317ed9cdec579ae1cb16d64f779032f44781e92acf8ae5526996c214b9ca3fc1137d055d73e5a89f99bbe06ef8c26725b755541
SSDEEP

24576:a39zCFPB8UAQcZ+rU6T1Ir+gqEWSzHP7qZJ+gIF:axCFJ8QR71I6g3hHidIF

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  8a074fe4a891e4468fc41e1fd721cd1192013922e192708e5fd9d0bde51a63fe
- Size
  
  781KB
- MD5
  
  913068eac706d8b4a9fc5e50834f9410
- SHA1
  
  a3ad7fde1e53dd274e321cebbd676505c46ca094
- SHA256
  
  8a074fe4a891e4468fc41e1fd721cd1192013922e192708e5fd9d0bde51a63fe
- SHA512
  
  efaddc6916e996c72ebc27afd317ed9cdec579ae1cb16d64f779032f44781e92acf8ae5526996c214b9ca3fc1137d055d73e5a89f99bbe06ef8c26725b755541
- SSDEEP
  
  24576:a39zCFPB8UAQcZ+rU6T1Ir+gqEWSzHP7qZJ+gIF:axCFJ8QR71I6g3hHidIF
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2