Overview

overview

8

Static

static

c516e5f122...f9.exe

windows7-x64

8

c516e5f122...f9.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    c516e5f1222f9daf95fefc1ded90bc5bfb68a7258ff465ddefb3105254db25f9

  • Size

    798KB

  • Sample

    221201-wn4a6shd9z

  • MD5

    c3c4403512db4c60b0f1d9dd9f0cadf4

  • SHA1

    64cdae8d8d39779f8ba7d805343f05d23c5d5a86

  • SHA256

    c516e5f1222f9daf95fefc1ded90bc5bfb68a7258ff465ddefb3105254db25f9

  • SHA512

    09e6c12d34b79e40c1451c067d6094f401b66c7caea4ec35217e797a289e34610c62ce82cc1c73d9e8dbfb20f4587ec35cd4af120cc46b544b3147d743429059

  • SSDEEP

    12288:sJwILF7o1pGhzMXE/ikCByVIluJnHJuBn5f9kFV4EAxPon4LA:sL7o1cVMXE/6PlIuLu/4PXc

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      c516e5f1222f9daf95fefc1ded90bc5bfb68a7258ff465ddefb3105254db25f9

    • Size

      798KB

    • MD5

      c3c4403512db4c60b0f1d9dd9f0cadf4

    • SHA1

      64cdae8d8d39779f8ba7d805343f05d23c5d5a86

    • SHA256

      c516e5f1222f9daf95fefc1ded90bc5bfb68a7258ff465ddefb3105254db25f9

    • SHA512

      09e6c12d34b79e40c1451c067d6094f401b66c7caea4ec35217e797a289e34610c62ce82cc1c73d9e8dbfb20f4587ec35cd4af120cc46b544b3147d743429059

    • SSDEEP

      12288:sJwILF7o1pGhzMXE/ikCByVIluJnHJuBn5f9kFV4EAxPon4LA:sL7o1cVMXE/6PlIuLu/4PXc

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks