bcb321683ebf69f49b72dc028e77205ea7f5b865bd0c31d84decdaa3b83887f2 | Triage

Sharing

General

Target

bcb321683ebf69f49b72dc028e77205ea7f5b865bd0c31d84decdaa3b83887f2
Size

724KB
Sample

221127-vpkpsahc6y
MD5

30627f01a24396767a87b47aa1db45d0
SHA1

e172064ff787602fd9ab66c2d7f32ed095acb12f
SHA256

bcb321683ebf69f49b72dc028e77205ea7f5b865bd0c31d84decdaa3b83887f2
SHA512

4f5557228b50c7c84c3224382b261c7b66a89baadf4da21f5f2acdc418d1abe21aca63fce2bd0c0d26c592918beea5a75198155f68d6af4090786aa832fada91
SSDEEP

12288:/7BCKBmsf7G9HXVmLnrzqb7FA1+HXIKSrlIDggNE0G/+x9VWAMm89fmSsM3VEX:/73fgmLnCbe1+HXIosga0GWLWvr9OSsM

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  bcb321683ebf69f49b72dc028e77205ea7f5b865bd0c31d84decdaa3b83887f2
- Size
  
  724KB
- MD5
  
  30627f01a24396767a87b47aa1db45d0
- SHA1
  
  e172064ff787602fd9ab66c2d7f32ed095acb12f
- SHA256
  
  bcb321683ebf69f49b72dc028e77205ea7f5b865bd0c31d84decdaa3b83887f2
- SHA512
  
  4f5557228b50c7c84c3224382b261c7b66a89baadf4da21f5f2acdc418d1abe21aca63fce2bd0c0d26c592918beea5a75198155f68d6af4090786aa832fada91
- SSDEEP
  
  12288:/7BCKBmsf7G9HXVmLnrzqb7FA1+HXIKSrlIDggNE0G/+x9VWAMm89fmSsM3VEX:/73fgmLnCbe1+HXIosga0GWLWvr9OSsM
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2