Overview

overview

9

Static

static

1

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36341d6828e44384b277452445f1e1615bca9cec53aea9bdf613ccd7e2d5c2d0

  • Size

    3.4MB

  • Sample

    230317-17ejdacc4t

  • MD5

    c93b60903bc7b17dd533ec96e2d33870

  • SHA1

    0d55d5e3d48e7bec70cfe0bdd2f5e17d09774c96

  • SHA256

    36341d6828e44384b277452445f1e1615bca9cec53aea9bdf613ccd7e2d5c2d0

  • SHA512

    14f851780eb630d0e885587880140670d6edf4bb118f0cf6297e7c450af32a0ebfe198b9971b7df402fc2299fb896e09c5b14236b6cd32452e9e3791ee8752d4

  • SSDEEP

    98304:VaD2xzt49ndR/hqOAX7Jhh15VRN6UnNOzFm:lt4rqN19nP

Score
9/10
discoveryevasiontrojanupx

Malware Config

Targets

    • Target

      36341d6828e44384b277452445f1e1615bca9cec53aea9bdf613ccd7e2d5c2d0

    • Size

      3.4MB

    • MD5

      c93b60903bc7b17dd533ec96e2d33870

    • SHA1

      0d55d5e3d48e7bec70cfe0bdd2f5e17d09774c96

    • SHA256

      36341d6828e44384b277452445f1e1615bca9cec53aea9bdf613ccd7e2d5c2d0

    • SHA512

      14f851780eb630d0e885587880140670d6edf4bb118f0cf6297e7c450af32a0ebfe198b9971b7df402fc2299fb896e09c5b14236b6cd32452e9e3791ee8752d4

    • SSDEEP

      98304:VaD2xzt49ndR/hqOAX7Jhh15VRN6UnNOzFm:lt4rqN19nP

    Score
    9/10
    discoveryevasiontrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks