333b5b430c6446df2056d6cc2e49b8765e3e390a26deb563b46d169af3856c0f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

333b5b430c6446df2056d6cc2e49b8765e3e390a26deb563b46d169af3856c0f
Size

512KB
Sample

221128-b6bnnaaf7y
MD5

5f55595bbb1007cfca889faac72d38f2
SHA1

7fe94b415396f0b7bbcf887ed90f140c6103b66d
SHA256

333b5b430c6446df2056d6cc2e49b8765e3e390a26deb563b46d169af3856c0f
SHA512

8eca40c8ee05880aae3db6424ee19c6d83dc351387281ae918fbbc88b59175d05bbc3140796ba8e7a25ae7e62e2f3c39911a7293f3e92745baff8bb852ea3362
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4b:0+h9OY70z+warul3E4b

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  333b5b430c6446df2056d6cc2e49b8765e3e390a26deb563b46d169af3856c0f
- Size
  
  512KB
- MD5
  
  5f55595bbb1007cfca889faac72d38f2
- SHA1
  
  7fe94b415396f0b7bbcf887ed90f140c6103b66d
- SHA256
  
  333b5b430c6446df2056d6cc2e49b8765e3e390a26deb563b46d169af3856c0f
- SHA512
  
  8eca40c8ee05880aae3db6424ee19c6d83dc351387281ae918fbbc88b59175d05bbc3140796ba8e7a25ae7e62e2f3c39911a7293f3e92745baff8bb852ea3362
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4b:0+h9OY70z+warul3E4b
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2