9ddc627ab07e9de801bb85d25a4803569d1535363f423612d68f0f79062afc08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9ddc627ab07e9de801bb85d25a4803569d1535363f423612d68f0f79062afc08
Size

791KB
Sample

221202-wfja2adh4t
MD5

b7ec79f8fad6c57a98f5505c16783840
SHA1

8161f5b2ac0486705f84743bfd8da9c848de9f79
SHA256

9ddc627ab07e9de801bb85d25a4803569d1535363f423612d68f0f79062afc08
SHA512

c462684d76998476df81b49fd192528e2ab941f8d78f1dd7cfaf1c0d625e9f4c223799e948e9b516581487b6abf1515477f33d81a328a9a7e388a88b8e89cc4d
SSDEEP

12288:ey89SAeVGpAuS0TMBc/l2QZ4XCUD7R3wM17/CjBtinNYsfasIuRcZF05iph62E37:189SAt33lj4XJCM17qjBteNY5s581Q

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  9ddc627ab07e9de801bb85d25a4803569d1535363f423612d68f0f79062afc08
- Size
  
  791KB
- MD5
  
  b7ec79f8fad6c57a98f5505c16783840
- SHA1
  
  8161f5b2ac0486705f84743bfd8da9c848de9f79
- SHA256
  
  9ddc627ab07e9de801bb85d25a4803569d1535363f423612d68f0f79062afc08
- SHA512
  
  c462684d76998476df81b49fd192528e2ab941f8d78f1dd7cfaf1c0d625e9f4c223799e948e9b516581487b6abf1515477f33d81a328a9a7e388a88b8e89cc4d
- SSDEEP
  
  12288:ey89SAeVGpAuS0TMBc/l2QZ4XCUD7R3wM17/CjBtinNYsfasIuRcZF05iph62E37:189SAt33lj4XJCM17qjBteNY5s581Q
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2