Overview

overview

9

Static

static

1

db987a333d...1b.exe

windows7-x64

9

db987a333d...1b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db987a333db1a199d58f3ab42e16e70a64f1f8e28eb20ce5c9ee3d607440021b

  • Size

    180KB

  • Sample

    221123-m5z6eaba6v

  • MD5

    964f7fa4c768df20ad129ff6a85a73c7

  • SHA1

    5222f70a5ccca4f667fad53f0f46f5524c34afec

  • SHA256

    db987a333db1a199d58f3ab42e16e70a64f1f8e28eb20ce5c9ee3d607440021b

  • SHA512

    43f018a47e0806f2863babcac6d280faf40803f67f12f94029227cfdb0083d5fb02be56529218c3f0d73cd775b50883f9836a35871873838a08b5fadce60ba15

  • SSDEEP

    3072:1QIURTXJ545nm9Ta10eKTXLVojYKQa6VuryijIGdRz68qmUrp3EpuXREVq0T1C:1s3rG12TRosKD6Syi8Gb81EQh8C

Score
9/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      db987a333db1a199d58f3ab42e16e70a64f1f8e28eb20ce5c9ee3d607440021b

    • Size

      180KB

    • MD5

      964f7fa4c768df20ad129ff6a85a73c7

    • SHA1

      5222f70a5ccca4f667fad53f0f46f5524c34afec

    • SHA256

      db987a333db1a199d58f3ab42e16e70a64f1f8e28eb20ce5c9ee3d607440021b

    • SHA512

      43f018a47e0806f2863babcac6d280faf40803f67f12f94029227cfdb0083d5fb02be56529218c3f0d73cd775b50883f9836a35871873838a08b5fadce60ba15

    • SSDEEP

      3072:1QIURTXJ545nm9Ta10eKTXLVojYKQa6VuryijIGdRz68qmUrp3EpuXREVq0T1C:1s3rG12TRosKD6Syi8Gb81EQh8C

    Score
    9/10
    evasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks