1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2
Size

1.7MB
Sample

221206-p66exsae44
MD5

18e53aa829155db8e698f53e142cd4f4
SHA1

12123449252992b6228968d7fca518e5f2c767dd
SHA256

1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2
SHA512

4ce72f7b3bb1bed62c7ad4dd6ff51fbd702ef38d86b159351e6ddf7874a4cf57f54c9a223df1e3bf1a4780a07850da8f6f073bfb6a5b0172eb6b62b541736770
SSDEEP

24576:3nxpEKzHXmW1+9VRMSTn9mqvED6FuYLfADPSVaZ28ycZ9/hLw7i:3nxCcGvRb9mL686ADPSV62m1Zw7

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2
- Size
  
  1.7MB
- MD5
  
  18e53aa829155db8e698f53e142cd4f4
- SHA1
  
  12123449252992b6228968d7fca518e5f2c767dd
- SHA256
  
  1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2
- SHA512
  
  4ce72f7b3bb1bed62c7ad4dd6ff51fbd702ef38d86b159351e6ddf7874a4cf57f54c9a223df1e3bf1a4780a07850da8f6f073bfb6a5b0172eb6b62b541736770
- SSDEEP
  
  24576:3nxpEKzHXmW1+9VRMSTn9mqvED6FuYLfADPSVaZ28ycZ9/hLw7i:3nxCcGvRb9mL686ADPSV62m1Zw7
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2