f5942b06a8eef8f214eb95021dd835b44d20d562f703a63fa2832d82935caeae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5942b06a8eef8f214eb95021dd835b44d20d562f703a63fa2832d82935caeae
Size

975KB
Sample

221127-rx15ysea82
MD5

74b8114a2e2a16dc20a7063749428c92
SHA1

e4eb653f68521c20dc72ea85e3fa7c8f083653b3
SHA256

f5942b06a8eef8f214eb95021dd835b44d20d562f703a63fa2832d82935caeae
SHA512

11c217075bdfe13b0c63cf727e4889716aacca42efcbe2861c6f52e8e39c25172730085d5210edc2ba54eebb3663a995a2c3f9f7b47db017fb291b31ec0ca231
SSDEEP

12288:N0UaD0ePLRx/u3PALNbaBbJvSW8WZTgkWEzsx+7IlqXRxQFNt6gsh37SBafFMZLK:u0ejzufAta7/ZTgxEO+7IlqHF3kp07

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  f5942b06a8eef8f214eb95021dd835b44d20d562f703a63fa2832d82935caeae
- Size
  
  975KB
- MD5
  
  74b8114a2e2a16dc20a7063749428c92
- SHA1
  
  e4eb653f68521c20dc72ea85e3fa7c8f083653b3
- SHA256
  
  f5942b06a8eef8f214eb95021dd835b44d20d562f703a63fa2832d82935caeae
- SHA512
  
  11c217075bdfe13b0c63cf727e4889716aacca42efcbe2861c6f52e8e39c25172730085d5210edc2ba54eebb3663a995a2c3f9f7b47db017fb291b31ec0ca231
- SSDEEP
  
  12288:N0UaD0ePLRx/u3PALNbaBbJvSW8WZTgkWEzsx+7IlqXRxQFNt6gsh37SBafFMZLK:u0ejzufAta7/ZTgxEO+7IlqHF3kp07
Score

9^/10

evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2