e6635b508fda10bcdac6c42de3393be098f24a5b66248f84ccd952388f3a50be | Triage

Sharing

General

Target

e6635b508fda10bcdac6c42de3393be098f24a5b66248f84ccd952388f3a50be
Size

1.2MB
Sample

221127-thlstsad34
MD5

8b2b9c0129c573553c2330cb6ee4fdee
SHA1

51114cdfa4ca12c56b6a9d5ab05673b683f87900
SHA256

e6635b508fda10bcdac6c42de3393be098f24a5b66248f84ccd952388f3a50be
SHA512

b7419c9a37dec951896e21415a89fcc9dea34941bd298e45b25f2814dee6f03ef4519339e641225b354646cb63170c25884775b2e3f7a3a2288c3a7e769a5383
SSDEEP

24576:J8xWGRs0FQUHFqQsPKpSq0Ohcy5udCgFIcsOWInbfyGUD:GW0TlHFqQ8Kf0Ohx5udzDsOWofzUD

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  e6635b508fda10bcdac6c42de3393be098f24a5b66248f84ccd952388f3a50be
- Size
  
  1.2MB
- MD5
  
  8b2b9c0129c573553c2330cb6ee4fdee
- SHA1
  
  51114cdfa4ca12c56b6a9d5ab05673b683f87900
- SHA256
  
  e6635b508fda10bcdac6c42de3393be098f24a5b66248f84ccd952388f3a50be
- SHA512
  
  b7419c9a37dec951896e21415a89fcc9dea34941bd298e45b25f2814dee6f03ef4519339e641225b354646cb63170c25884775b2e3f7a3a2288c3a7e769a5383
- SSDEEP
  
  24576:J8xWGRs0FQUHFqQsPKpSq0Ohcy5udCgFIcsOWInbfyGUD:GW0TlHFqQ8Kf0Ohx5udzDsOWofzUD
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2