Overview

overview

9

Static

static

6eafee2376...ab.exe

windows7-x64

9

6eafee2376...ab.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    6eafee2376b8bdda3583429cf1aed025b362f615ad3f76b29628f9595662abab

  • Size

    512KB

  • Sample

    221127-11ntgaga4t

  • MD5

    1468045415e0b72785c22067792ab317

  • SHA1

    64ddb3ab48555fa5f5a18f00c1dc87bda647f98f

  • SHA256

    6eafee2376b8bdda3583429cf1aed025b362f615ad3f76b29628f9595662abab

  • SHA512

    acdfa9037fa89615353001c599682fb7866d86b6e9252a597be84a93b98a1c04d1ecb99f3be5c9278ea143a400d1f0e0d34d89cfba1ab0c18b2f9e8331c4846e

  • SSDEEP

    12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4Q:0+h9OY70z+warul3E4Q

Score
9/10
evasion

Malware Config

Targets

    • Target

      6eafee2376b8bdda3583429cf1aed025b362f615ad3f76b29628f9595662abab

    • Size

      512KB

    • MD5

      1468045415e0b72785c22067792ab317

    • SHA1

      64ddb3ab48555fa5f5a18f00c1dc87bda647f98f

    • SHA256

      6eafee2376b8bdda3583429cf1aed025b362f615ad3f76b29628f9595662abab

    • SHA512

      acdfa9037fa89615353001c599682fb7866d86b6e9252a597be84a93b98a1c04d1ecb99f3be5c9278ea143a400d1f0e0d34d89cfba1ab0c18b2f9e8331c4846e

    • SSDEEP

      12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4Q:0+h9OY70z+warul3E4Q

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks