Overview

overview

9

Static

static

a8e1812e97...1a.exe

windows7-x64

9

a8e1812e97...1a.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8e1812e97ebaeba43c255bc07b85f8ba75e33280ac1802674e1741b5811d91a

  • Size

    601KB

  • Sample

    221127-nyz3haec89

  • MD5

    6e681efc638d9c30f181e4743b47fe10

  • SHA1

    51cc7f9313497fb7043f1adea55eb05a19a9e5f2

  • SHA256

    a8e1812e97ebaeba43c255bc07b85f8ba75e33280ac1802674e1741b5811d91a

  • SHA512

    696ccf5140362844a4603b721af080acf67e59ac27c6a275980cc093112534018b90f598e983bb570d4066cf85a39b5edae0224f1a58cf05008845950c9d0e04

  • SSDEEP

    12288:xORNsuj7LM2e2Bl4St2AxKeAN+GKnvLof/9WraN0bfs3kZwD+ZAd7:xsNsmM2lBmSt2A+yTof/YrdfqkZwD4Ax

Score
9/10
evasion

Malware Config

Targets

    • Target

      a8e1812e97ebaeba43c255bc07b85f8ba75e33280ac1802674e1741b5811d91a

    • Size

      601KB

    • MD5

      6e681efc638d9c30f181e4743b47fe10

    • SHA1

      51cc7f9313497fb7043f1adea55eb05a19a9e5f2

    • SHA256

      a8e1812e97ebaeba43c255bc07b85f8ba75e33280ac1802674e1741b5811d91a

    • SHA512

      696ccf5140362844a4603b721af080acf67e59ac27c6a275980cc093112534018b90f598e983bb570d4066cf85a39b5edae0224f1a58cf05008845950c9d0e04

    • SSDEEP

      12288:xORNsuj7LM2e2Bl4St2AxKeAN+GKnvLof/9WraN0bfs3kZwD+ZAd7:xsNsmM2lBmSt2A+yTof/YrdfqkZwD4Ax

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks