a337a32e4b79ded7bc1eab26ba028cbdf72ae773ebfecbfe8a0f6f940d91b43a | Triage

Sharing

General

Target

a337a32e4b79ded7bc1eab26ba028cbdf72ae773ebfecbfe8a0f6f940d91b43a
Size

512KB
Sample

221128-ay5fbsbc57
MD5

cae6db91ba40e52d21e3c01abf152a55
SHA1

0319f4efa0a97e6b12266f3cc9383f4a366cbcfe
SHA256

a337a32e4b79ded7bc1eab26ba028cbdf72ae773ebfecbfe8a0f6f940d91b43a
SHA512

947ce311c708f967f41f994d4ae45b04183abdfbd127d0098040a1f0d705cc70e3c7e9acccfc8b3e3411b4af52328738305ad290298435a01d5a3c5b4bcb8340
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4I:0+h9OY70z+warul3E4I

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  a337a32e4b79ded7bc1eab26ba028cbdf72ae773ebfecbfe8a0f6f940d91b43a
- Size
  
  512KB
- MD5
  
  cae6db91ba40e52d21e3c01abf152a55
- SHA1
  
  0319f4efa0a97e6b12266f3cc9383f4a366cbcfe
- SHA256
  
  a337a32e4b79ded7bc1eab26ba028cbdf72ae773ebfecbfe8a0f6f940d91b43a
- SHA512
  
  947ce311c708f967f41f994d4ae45b04183abdfbd127d0098040a1f0d705cc70e3c7e9acccfc8b3e3411b4af52328738305ad290298435a01d5a3c5b4bcb8340
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4I:0+h9OY70z+warul3E4I
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2