c512020d19840d958b4ef0a018e26ae3111a639b7b9f527a24b57ad4b4451cdf | Triage

Sharing

General

Target

c512020d19840d958b4ef0a018e26ae3111a639b7b9f527a24b57ad4b4451cdf
Size

671KB
Sample

221130-3l2swseh55
MD5

466f990b524c13d04ff74f2f1f57d3b2
SHA1

8c3d9b09e9268573f9ef6ce8c23c07e0ee25fc9b
SHA256

c512020d19840d958b4ef0a018e26ae3111a639b7b9f527a24b57ad4b4451cdf
SHA512

dda039d1199a1a2868c6ad459e5e1d970ff35efb1c9a1725bbe015d5d96ea993e3c3d9307ab492a609a8a81adbf3fb01a1014c383dddf1126fae696d9121d019
SSDEEP

12288:3Estirr3ODMrtNj+VO6XjkIDweL0h21fgR4VkcEmVAloc3OlcrAtb7n0E4zG:3JMrr+YrtNj+VO6TlW21fgRL7mVZ90EJ

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  c512020d19840d958b4ef0a018e26ae3111a639b7b9f527a24b57ad4b4451cdf
- Size
  
  671KB
- MD5
  
  466f990b524c13d04ff74f2f1f57d3b2
- SHA1
  
  8c3d9b09e9268573f9ef6ce8c23c07e0ee25fc9b
- SHA256
  
  c512020d19840d958b4ef0a018e26ae3111a639b7b9f527a24b57ad4b4451cdf
- SHA512
  
  dda039d1199a1a2868c6ad459e5e1d970ff35efb1c9a1725bbe015d5d96ea993e3c3d9307ab492a609a8a81adbf3fb01a1014c383dddf1126fae696d9121d019
- SSDEEP
  
  12288:3Estirr3ODMrtNj+VO6XjkIDweL0h21fgR4VkcEmVAloc3OlcrAtb7n0E4zG:3JMrr+YrtNj+VO6TlW21fgRL7mVZ90EJ
Score

9^/10

evasion persistence
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence