Overview

overview

9

Static

static

abe9e6d83b...d8.exe

windows7-x64

9

abe9e6d83b...d8.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    abe9e6d83b7b1f99a7ae1435143e2fd05c3c3abde2c56059078f229cf44769d8

  • Size

    422KB

  • Sample

    221124-eqm9asbd7y

  • MD5

    598aca1d2f65bceb1ef9f31ad2ab96fe

  • SHA1

    fbbeaebab493d82f820e50207fb0a267e9c04a8e

  • SHA256

    abe9e6d83b7b1f99a7ae1435143e2fd05c3c3abde2c56059078f229cf44769d8

  • SHA512

    83cf96f9867f905f4e6e0522f29e8ed07923c71bef87cf760a92dbc588ef4fa62135f455acc0933bdf6a8a0fd482b7a0086cd9c0d24e5fad5e96bdb5539388af

  • SSDEEP

    6144:wOB3BjusqfPPuL0aEMcTOFunAQj83SRUkaBYgV2kxEYbzVMPkJY7R3rAzqB6BP01:wOBoGL0asOfT2kxE6mwWR3k2IjW

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      abe9e6d83b7b1f99a7ae1435143e2fd05c3c3abde2c56059078f229cf44769d8

    • Size

      422KB

    • MD5

      598aca1d2f65bceb1ef9f31ad2ab96fe

    • SHA1

      fbbeaebab493d82f820e50207fb0a267e9c04a8e

    • SHA256

      abe9e6d83b7b1f99a7ae1435143e2fd05c3c3abde2c56059078f229cf44769d8

    • SHA512

      83cf96f9867f905f4e6e0522f29e8ed07923c71bef87cf760a92dbc588ef4fa62135f455acc0933bdf6a8a0fd482b7a0086cd9c0d24e5fad5e96bdb5539388af

    • SSDEEP

      6144:wOB3BjusqfPPuL0aEMcTOFunAQj83SRUkaBYgV2kxEYbzVMPkJY7R3rAzqB6BP01:wOBoGL0asOfT2kxE6mwWR3k2IjW

    Score
    9/10
    evasionpersistence

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks