82cf833c785fceea63dea2e81a8ef6509b5af00fd3de6357cce612a1a41083ea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82cf833c785fceea63dea2e81a8ef6509b5af00fd3de6357cce612a1a41083ea
Size

625KB
Sample

221127-m7xs3acc47
MD5

818afd45a51680f4852ef1a981f188fc
SHA1

d800b1415b5ecdcc9830f0fffe7e949df7dd419d
SHA256

82cf833c785fceea63dea2e81a8ef6509b5af00fd3de6357cce612a1a41083ea
SHA512

457638fb2bf71009e50032ba14d8f6ee15f352e0cabedce23519662169f5dc3181f21c7583f8648670ea2cfc0305c96fbbd428250cf36818a069e66638e68e12
SSDEEP

12288:hg+gjjwmSK3ALgXgxvFDyfD1XBxzHMT0jZOJk7j4epPfArQyX0kZ2GEV4gB4IjYx:CjjwS3UW0NKhXLNjZzTPIrQu0kZCV4gg

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  82cf833c785fceea63dea2e81a8ef6509b5af00fd3de6357cce612a1a41083ea
- Size
  
  625KB
- MD5
  
  818afd45a51680f4852ef1a981f188fc
- SHA1
  
  d800b1415b5ecdcc9830f0fffe7e949df7dd419d
- SHA256
  
  82cf833c785fceea63dea2e81a8ef6509b5af00fd3de6357cce612a1a41083ea
- SHA512
  
  457638fb2bf71009e50032ba14d8f6ee15f352e0cabedce23519662169f5dc3181f21c7583f8648670ea2cfc0305c96fbbd428250cf36818a069e66638e68e12
- SSDEEP
  
  12288:hg+gjjwmSK3ALgXgxvFDyfD1XBxzHMT0jZOJk7j4epPfArQyX0kZ2GEV4gB4IjYx:CjjwS3UW0NKhXLNjZzTPIrQu0kZCV4gg
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2