427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
Size

93KB
Sample

221126-afzr5agf95
MD5

079ba434001a1d9d2425a5a7b18700c9
SHA1

5654f1fb464984098c615d91059e4bd328cec508
SHA256

427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
SHA512

0ebb562406174c10db1b1c9db1cbb5cb574e133ca803319ebddadafb514a4d614b5e38062688ee3b4b3e0687d9f636fbf1d206587e8f53c5730239d8029e7fc8
SSDEEP

1536:VJLg6/ZRSN0CAk1M4Bgke5GZFVnTh1jjVBFjtSLA/lylHwc:PV/L4081MSZe5GZFVnTh1jj5xlyhL

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
- Size
  
  93KB
- MD5
  
  079ba434001a1d9d2425a5a7b18700c9
- SHA1
  
  5654f1fb464984098c615d91059e4bd328cec508
- SHA256
  
  427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
- SHA512
  
  0ebb562406174c10db1b1c9db1cbb5cb574e133ca803319ebddadafb514a4d614b5e38062688ee3b4b3e0687d9f636fbf1d206587e8f53c5730239d8029e7fc8
- SSDEEP
  
  1536:VJLg6/ZRSN0CAk1M4Bgke5GZFVnTh1jjVBFjtSLA/lylHwc:PV/L4081MSZe5GZFVnTh1jj5xlyhL
Score

9^/10

evasion persistence
- Looks for VirtualBox Guest Additions in registry
  evasion
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence