Overview

overview

9

Static

static

334ce7f8a7...99.exe

windows7-x64

9

334ce7f8a7...99.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    334ce7f8a78bd6cc73999cdda240d10036df7d14fb8734be67aab6d595e81f99

  • Size

    2.8MB

  • Sample

    221127-jtdw9abb82

  • MD5

    2bb05dfd267dfea1ca574d08359144ea

  • SHA1

    5978d0c2e3418027fae19f56329c1600b9aa3b65

  • SHA256

    334ce7f8a78bd6cc73999cdda240d10036df7d14fb8734be67aab6d595e81f99

  • SHA512

    9db1c587737ac860332e52b5c515856c03ffc404c9e1b0cbaac50a34aaa3a489cbbee4a94b00426650799094db9850bebf5027ac3a29d5d008af156697a7f6f1

  • SSDEEP

    49152:WBPe48AO2okvBVaax222FEOZzr0YgAbfNpCUhv3/ndAjgN7QFd7IYDhkPekUe:OG4dO2dPcykMvslcUhvPndigOTUn

Score
9/10
evasion

Malware Config

Targets

    • Target

      334ce7f8a78bd6cc73999cdda240d10036df7d14fb8734be67aab6d595e81f99

    • Size

      2.8MB

    • MD5

      2bb05dfd267dfea1ca574d08359144ea

    • SHA1

      5978d0c2e3418027fae19f56329c1600b9aa3b65

    • SHA256

      334ce7f8a78bd6cc73999cdda240d10036df7d14fb8734be67aab6d595e81f99

    • SHA512

      9db1c587737ac860332e52b5c515856c03ffc404c9e1b0cbaac50a34aaa3a489cbbee4a94b00426650799094db9850bebf5027ac3a29d5d008af156697a7f6f1

    • SSDEEP

      49152:WBPe48AO2okvBVaax222FEOZzr0YgAbfNpCUhv3/ndAjgN7QFd7IYDhkPekUe:OG4dO2dPcykMvslcUhvPndigOTUn

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks