Overview

overview

10

Static

static

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan-Ransom.Win32.Blocker.dopg-6d23133cc2b9d0d7787bafcd36712696470ca26a62e4a902e51c45e691e48aa4

  • Size

    1.4MB

  • Sample

    221106-wxq27shbej

  • MD5

    652d74094e72b6c3e51a75c6d350c896

  • SHA1

    67e11c27b493946e66c6aa67301d3d190e5d176c

  • SHA256

    6d23133cc2b9d0d7787bafcd36712696470ca26a62e4a902e51c45e691e48aa4

  • SHA512

    fe58b350551e2bba1e160d64d42f1f3c28a88cc4364a32ea5ead9dd479224d58b31e204acedfa007170ea5587919d2061d2f15fd128996b3ce1fb41c1ed0b428

  • SSDEEP

    24576:oN9QNHMEMPAhssp0ZCB3WynPPKOWPSrubnUOv0OnJXWqhOYdQHRoNmLY06u/PLx+:296DM4i8PnPRoSyYO8gmqP2Ro0LYILd6

Score
10/10
evasiontrojan

Malware Config

Targets

    • Target

      Trojan-Ransom.Win32.Blocker.dopg-6d23133cc2b9d0d7787bafcd36712696470ca26a62e4a902e51c45e691e48aa4

    • Size

      1.4MB

    • MD5

      652d74094e72b6c3e51a75c6d350c896

    • SHA1

      67e11c27b493946e66c6aa67301d3d190e5d176c

    • SHA256

      6d23133cc2b9d0d7787bafcd36712696470ca26a62e4a902e51c45e691e48aa4

    • SHA512

      fe58b350551e2bba1e160d64d42f1f3c28a88cc4364a32ea5ead9dd479224d58b31e204acedfa007170ea5587919d2061d2f15fd128996b3ce1fb41c1ed0b428

    • SSDEEP

      24576:oN9QNHMEMPAhssp0ZCB3WynPPKOWPSrubnUOv0OnJXWqhOYdQHRoNmLY06u/PLx+:296DM4i8PnPRoSyYO8gmqP2Ro0LYILd6

    Score
    10/10
    evasiontrojan

    • UAC bypass

      evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks