d5123091b0a772e949619e61a8bd5ee354d50bab994bb8d6c5bcaa9bc24fbef1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5123091b0a772e949619e61a8bd5ee354d50bab994bb8d6c5bcaa9bc24fbef1
Size

155KB
Sample

221127-zjry5agd92
MD5

e51e3d5711bb87b76d703e10c4bad01a
SHA1

21410b5fe87e9c8394f535485cc92d00ae3b795a
SHA256

d5123091b0a772e949619e61a8bd5ee354d50bab994bb8d6c5bcaa9bc24fbef1
SHA512

32a4491e4f8c86dfb6e156f61440a8a7ba297ffb1b484ae3ab8766efb20b3b2a6d87ae35ece51dd4c781be1e5d2666d793e5eb8a74637b478b376a7fe2881b4a
SSDEEP

3072:lM+9i7SFCIXJZtWrl7fZt0Jhko4hMlFuWUwwMzhUmjapUmDV5jnQDntiPmowOv:lMTCPsBNtI4hjrbEtjRm7jnAtQm98

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  d5123091b0a772e949619e61a8bd5ee354d50bab994bb8d6c5bcaa9bc24fbef1
- Size
  
  155KB
- MD5
  
  e51e3d5711bb87b76d703e10c4bad01a
- SHA1
  
  21410b5fe87e9c8394f535485cc92d00ae3b795a
- SHA256
  
  d5123091b0a772e949619e61a8bd5ee354d50bab994bb8d6c5bcaa9bc24fbef1
- SHA512
  
  32a4491e4f8c86dfb6e156f61440a8a7ba297ffb1b484ae3ab8766efb20b3b2a6d87ae35ece51dd4c781be1e5d2666d793e5eb8a74637b478b376a7fe2881b4a
- SSDEEP
  
  3072:lM+9i7SFCIXJZtWrl7fZt0Jhko4hMlFuWUwwMzhUmjapUmDV5jnQDntiPmowOv:lMTCPsBNtI4hjrbEtjRm7jnAtQm98
Score

9^/10

evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2