65d0399628b823ee5b72e20d7302a25e517eeb7e17f32752525a082bc9be07c2 | Triage

Sharing

General

Target

65d0399628b823ee5b72e20d7302a25e517eeb7e17f32752525a082bc9be07c2
Size

913KB
Sample

221124-espvxabe91
MD5

f161b20769be70e43072cc038eed8392
SHA1

750b87f7e0161eaf828390b21a1469d8f0f32c4c
SHA256

65d0399628b823ee5b72e20d7302a25e517eeb7e17f32752525a082bc9be07c2
SHA512

0f4e8c845da5d0c9f94efa2c01c73aefebb2496e052d5212063f1799d14ebad35567b5ecf0b9446dde31dd962bbcf5951d713ad7c450e36eaf1ee512afca8052
SSDEEP

24576:NJ2jnlasZPd4h0PEZys9sIgZhsneIZB1Pb/pAdwNLPoUentzQBr:z2RBZPqh0PgTgZhsneIlbRAdGwU4yr

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  65d0399628b823ee5b72e20d7302a25e517eeb7e17f32752525a082bc9be07c2
- Size
  
  913KB
- MD5
  
  f161b20769be70e43072cc038eed8392
- SHA1
  
  750b87f7e0161eaf828390b21a1469d8f0f32c4c
- SHA256
  
  65d0399628b823ee5b72e20d7302a25e517eeb7e17f32752525a082bc9be07c2
- SHA512
  
  0f4e8c845da5d0c9f94efa2c01c73aefebb2496e052d5212063f1799d14ebad35567b5ecf0b9446dde31dd962bbcf5951d713ad7c450e36eaf1ee512afca8052
- SSDEEP
  
  24576:NJ2jnlasZPd4h0PEZys9sIgZhsneIZB1Pb/pAdwNLPoUentzQBr:z2RBZPqh0PgTgZhsneIlbRAdGwU4yr
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2