d0f0cc9987c381ea6e84dc9d32e082a1615381cf598b2d1395ccf27e60c4db42 | Triage

Sharing

General

Target

d0f0cc9987c381ea6e84dc9d32e082a1615381cf598b2d1395ccf27e60c4db42
Size

800KB
Sample

221128-d2axnsff2y
MD5

ad3b6bd6123c2dd2d90bff326929e8cd
SHA1

a6b832de9ab1df9cd13dc66151a50362d3f013ad
SHA256

d0f0cc9987c381ea6e84dc9d32e082a1615381cf598b2d1395ccf27e60c4db42
SHA512

a8e8035d7fc4c50f634545ff676ec25ceedd6ce7e9eb119cdd8de05f5b150520d5ff279cedaa5961e763ca325dd8707e6fd9167642d93ed246c93f0a35b13848
SSDEEP

12288:4KcQ6ahMhqqZv2JW3rVnb9M62ZuX8hdVEEh3zDsBj3sw:8a3KZSZuXwhDDspsw

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  d0f0cc9987c381ea6e84dc9d32e082a1615381cf598b2d1395ccf27e60c4db42
- Size
  
  800KB
- MD5
  
  ad3b6bd6123c2dd2d90bff326929e8cd
- SHA1
  
  a6b832de9ab1df9cd13dc66151a50362d3f013ad
- SHA256
  
  d0f0cc9987c381ea6e84dc9d32e082a1615381cf598b2d1395ccf27e60c4db42
- SHA512
  
  a8e8035d7fc4c50f634545ff676ec25ceedd6ce7e9eb119cdd8de05f5b150520d5ff279cedaa5961e763ca325dd8707e6fd9167642d93ed246c93f0a35b13848
- SSDEEP
  
  12288:4KcQ6ahMhqqZv2JW3rVnb9M62ZuX8hdVEEh3zDsBj3sw:8a3KZSZuXwhDDspsw
Score

9^/10

evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2