ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4 | Triage

Sharing

General

Target

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
Size

848KB
Sample

221126-vramlaag49
MD5

e631a4b49ba4d7f7b7c8564578fd7673
SHA1

db577da3897d30dcdf433a4c259482e6eb3cbc87
SHA256

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
SHA512

3042f1413f30546efadb414c3df9f009c2fa6124ac6d69094871ac5ff532645e0e30ba6321fdc336b6cb281439c7eb3d46fd2ec6ef30f09cf1ee0e129c52f4c1
SSDEEP

12288:apRj81QWO+7y3Adkjp5p/WHBAn3/LyTX+U3t3rHGnTyTqqUXy00iWLaVOZ7Zr6nf:08kjImn3G9rcy9UXXnWLaW7ZGneOca3

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
- Size
  
  848KB
- MD5
  
  e631a4b49ba4d7f7b7c8564578fd7673
- SHA1
  
  db577da3897d30dcdf433a4c259482e6eb3cbc87
- SHA256
  
  ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
- SHA512
  
  3042f1413f30546efadb414c3df9f009c2fa6124ac6d69094871ac5ff532645e0e30ba6321fdc336b6cb281439c7eb3d46fd2ec6ef30f09cf1ee0e129c52f4c1
- SSDEEP
  
  12288:apRj81QWO+7y3Adkjp5p/WHBAn3/LyTX+U3t3rHGnTyTqqUXy00iWLaVOZ7Zr6nf:08kjImn3G9rcy9UXXnWLaW7ZGneOca3
Score

9^/10

evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2