fee755beaee75b583aa7aed6856c36e6c2ffc1a6b8f9a9ae02a2b44bcf18dfb8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

botlucky-client.exe
Size

9.2MB
Sample

221125-s5cyrsgh82
MD5

8e48d8237eca1823a6dd88c560a3d9a9
SHA1

d0fecf2c9330f041156b3511ef93738a88972455
SHA256

fee755beaee75b583aa7aed6856c36e6c2ffc1a6b8f9a9ae02a2b44bcf18dfb8
SHA512

ddc3ca913e146b5534133665c679648907d10eef752bcaf38c858fa56469826d1d36776385c56dd68d68c167d44c588befeabe69ecb7ecb035e5e5506c8810d2
SSDEEP

196608:Ydw9Y1Mmx2dXzGo6nsVQ8ITGVFmFJ4FxnA/M3KE91Jaac3:YYmx2dDGo6IQ8fF4qA/MaIDc3

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  botlucky-client.exe
- Size
  
  9.2MB
- MD5
  
  8e48d8237eca1823a6dd88c560a3d9a9
- SHA1
  
  d0fecf2c9330f041156b3511ef93738a88972455
- SHA256
  
  fee755beaee75b583aa7aed6856c36e6c2ffc1a6b8f9a9ae02a2b44bcf18dfb8
- SHA512
  
  ddc3ca913e146b5534133665c679648907d10eef752bcaf38c858fa56469826d1d36776385c56dd68d68c167d44c588befeabe69ecb7ecb035e5e5506c8810d2
- SSDEEP
  
  196608:Ydw9Y1Mmx2dXzGo6nsVQ8ITGVFmFJ4FxnA/M3KE91Jaac3:YYmx2dDGo6IQ8fF4qA/MaIDc3
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2