Overview

overview

10

Static

static

AnyDesk.msi

windows7-x64

10

AnyDesk.msi

windows10-2004-x64

10

Resubmissions

10-01-2023 15:42

230110-s5dkasge64 10

10-01-2023 15:35

230110-s1ddqsge56 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AnyDesk.msi

  • Size

    5.2MB

  • Sample

    230110-s1ddqsge56

  • MD5

    8b5c001d696ec2cd730280496a311895

  • SHA1

    a1ad08a895037a8fc8a5fa7fda7bfba9894a9eac

  • SHA256

    e9d32103b6e9ab8fed7f6824525026119a5c5e9674522bdf0ebca8f242af10b1

  • SHA512

    1901f730d02d23fdc81ff7bda7d9a7d4deb37596cce076bb1555a391419f2520577fe8872cb5795f2ff64eede2d6e9bf72f4840696001a2f25acc5e8ddca86db

  • SSDEEP

    98304:dYGKdAHTgvVVqPvZpgvXM/N3qZBO0cY2YPGvhP0JGom:R8VqPvZ6v6NH0l7PXm

Score
10/10
lampionbankerevasionpersistencetrojan

Malware Config

Targets

    • Target

      AnyDesk.msi

    • Size

      5.2MB

    • MD5

      8b5c001d696ec2cd730280496a311895

    • SHA1

      a1ad08a895037a8fc8a5fa7fda7bfba9894a9eac

    • SHA256

      e9d32103b6e9ab8fed7f6824525026119a5c5e9674522bdf0ebca8f242af10b1

    • SHA512

      1901f730d02d23fdc81ff7bda7d9a7d4deb37596cce076bb1555a391419f2520577fe8872cb5795f2ff64eede2d6e9bf72f4840696001a2f25acc5e8ddca86db

    • SSDEEP

      98304:dYGKdAHTgvVVqPvZpgvXM/N3qZBO0cY2YPGvhP0JGom:R8VqPvZ6v6NH0l7PXm

    Score
    10/10
    lampionbankerevasionpersistencetrojan

    • Lampion

      Lampion is a banking trojan, targeting Portuguese speaking countries.

      trojanbankerlampion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

7
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks