General

  • Target

    install.exe

  • Size

    5MB

  • Sample

    230109-qc1g9aec44

  • MD5

    cc8618f1849063da10e5cae0e5ae10e9

  • SHA1

    9c3f426af7d3631fe098a4279170147623b8c6d7

  • SHA256

    730cdb4e43116e24a85393ff36bf5abdd467543e0df6a93b5c957cba38eb004d

  • SHA512

    f1222e54d51342a9e7fe0ee846a0c206f4e39b344d2534a83fadaf21e1f0d6dbcc4a065b135d78b5fa70f6530013b047e662eeafc2b2827bf63eca2ef31d65af

  • SSDEEP

    98304:6aefkdb1p/LtGyTjTxyB58V+asD+rE/Y3Fxh3+rSvd9PSWojTj9SlZLqLRZON82:N1BpVPsyuYzhurSvd9kBLTON82

Malware Config

Targets

    • Target

      install.exe

    • Size

      5MB

    • MD5

      cc8618f1849063da10e5cae0e5ae10e9

    • SHA1

      9c3f426af7d3631fe098a4279170147623b8c6d7

    • SHA256

      730cdb4e43116e24a85393ff36bf5abdd467543e0df6a93b5c957cba38eb004d

    • SHA512

      f1222e54d51342a9e7fe0ee846a0c206f4e39b344d2534a83fadaf21e1f0d6dbcc4a065b135d78b5fa70f6530013b047e662eeafc2b2827bf63eca2ef31d65af

    • SSDEEP

      98304:6aefkdb1p/LtGyTjTxyB58V+asD+rE/Y3Fxh3+rSvd9PSWojTj9SlZLqLRZON82:N1BpVPsyuYzhurSvd9kBLTON82

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Tasks