d738ac93cc0199ac90e8f973297f4a2449653cfd3bfad23ef2ebb1e04a4758ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d738ac93cc0199ac90e8f973297f4a2449653cfd3bfad23ef2ebb1e04a4758ba
Size

792KB
Sample

221203-phebjaaa78
MD5

6488d1a1ef5b3d0be4f7700a956412c0
SHA1

0dd54e6bb42d75f390785f1c1c7b6d8367ed3f5c
SHA256

d738ac93cc0199ac90e8f973297f4a2449653cfd3bfad23ef2ebb1e04a4758ba
SHA512

4648cd74ca29cff97cf34b2b5c9fe59afdf7ce36582041e012a3d3100023fa0e21075bf68daf024fa935b6c31f1f38cb61d763dd072961f679baa118b33a996c
SSDEEP

24576:zL0PKPDAe44DLwtVL54olRolaImjtUATC0:MPK7K14olRo0TGwb

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  d738ac93cc0199ac90e8f973297f4a2449653cfd3bfad23ef2ebb1e04a4758ba
- Size
  
  792KB
- MD5
  
  6488d1a1ef5b3d0be4f7700a956412c0
- SHA1
  
  0dd54e6bb42d75f390785f1c1c7b6d8367ed3f5c
- SHA256
  
  d738ac93cc0199ac90e8f973297f4a2449653cfd3bfad23ef2ebb1e04a4758ba
- SHA512
  
  4648cd74ca29cff97cf34b2b5c9fe59afdf7ce36582041e012a3d3100023fa0e21075bf68daf024fa935b6c31f1f38cb61d763dd072961f679baa118b33a996c
- SSDEEP
  
  24576:zL0PKPDAe44DLwtVL54olRolaImjtUATC0:MPK7K14olRo0TGwb
Score

9^/10

evasion persistence
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence