General

  • Target

    09b7b0acfc742ee42a84d758821762eb3f7263824b46d468b44031262c5d34e6

  • Size

    4.3MB

  • Sample

    221128-nfyfysab23

  • MD5

    6aadc34493259753df29c8b2e7c8ff0f

  • SHA1

    cb52ddb4da89d312d2c4ac56f3c71f5b0aca2f45

  • SHA256

    09b7b0acfc742ee42a84d758821762eb3f7263824b46d468b44031262c5d34e6

  • SHA512

    0cfa3f82d079f0bacb6bfc915b8780f80d33a9c2656c0fd5d495afb838219bc45138538ea54b48ea05d46fe423fa5062a3539c6892f4fa06221c743f0715633c

  • SSDEEP

    98304:PY88bYHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKP3Q9j:P9wGdjjqPdDsDbsU0akJyxL405+fiX

Score
9/10

Malware Config

Targets

    • Target

      09b7b0acfc742ee42a84d758821762eb3f7263824b46d468b44031262c5d34e6

    • Size

      4.3MB

    • MD5

      6aadc34493259753df29c8b2e7c8ff0f

    • SHA1

      cb52ddb4da89d312d2c4ac56f3c71f5b0aca2f45

    • SHA256

      09b7b0acfc742ee42a84d758821762eb3f7263824b46d468b44031262c5d34e6

    • SHA512

      0cfa3f82d079f0bacb6bfc915b8780f80d33a9c2656c0fd5d495afb838219bc45138538ea54b48ea05d46fe423fa5062a3539c6892f4fa06221c743f0715633c

    • SSDEEP

      98304:PY88bYHpNeV/riwz58R42is6e3RXjOWDucCnp1DA9sv7o2s2kbsUOEGx4VKP3Q9j:P9wGdjjqPdDsDbsU0akJyxL405+fiX

    Score
    9/10
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Tasks