02791d04904f59124ec6e7fa8d34fe919ca4ba836e12200dbe90298b3398a886 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02791d04904f59124ec6e7fa8d34fe919ca4ba836e12200dbe90298b3398a886
Size

991KB
Sample

221205-jbm27sgh33
MD5

ce398d76535ff8fa0d094012539227cc
SHA1

914de84ac538cfb73403b0f49fd0a473ab99bf25
SHA256

02791d04904f59124ec6e7fa8d34fe919ca4ba836e12200dbe90298b3398a886
SHA512

6accab2c1f10f198507a5191213781c780668f3af11fc6b7e24d42b7d4a1417a645b109dc30b08fe7edeb1843b2f38551e21a63d78ca600f8942db2a957ec9f6
SSDEEP

24576:Di1GxyG5RG3VP6R110vDeu6Z337sAqnOmLiQR7:DiR13VyRk1dNOmB7

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  02791d04904f59124ec6e7fa8d34fe919ca4ba836e12200dbe90298b3398a886
- Size
  
  991KB
- MD5
  
  ce398d76535ff8fa0d094012539227cc
- SHA1
  
  914de84ac538cfb73403b0f49fd0a473ab99bf25
- SHA256
  
  02791d04904f59124ec6e7fa8d34fe919ca4ba836e12200dbe90298b3398a886
- SHA512
  
  6accab2c1f10f198507a5191213781c780668f3af11fc6b7e24d42b7d4a1417a645b109dc30b08fe7edeb1843b2f38551e21a63d78ca600f8942db2a957ec9f6
- SSDEEP
  
  24576:Di1GxyG5RG3VP6R110vDeu6Z337sAqnOmLiQR7:DiR13VyRk1dNOmB7
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2