5db7e3cba3a56ea7265ac824f5b3bd64853e42c4fa9eb8a5e706bcad5acdff0e | Triage

Sharing

General

Target

RUT V3.exe
Size

10.6MB
Sample

230331-1ew8qadf48
MD5

a77c3c4678f20357d92bf98a5aa8979d
SHA1

1c1dbc0b54b20844e0b2ed1f4877bdcd6e062081
SHA256

5db7e3cba3a56ea7265ac824f5b3bd64853e42c4fa9eb8a5e706bcad5acdff0e
SHA512

d896a03e3d3fc4f28cc07b718e289350b87fbd896bdf3fd487bfb3686afe4c35dd87cbe519cdb9b352c5426ae5c17733f106b8c1a7176a8e5cf85597b6af35f8
SSDEEP

196608:2tz+SDWS8v80ix2Wa88Vb6FN20vmtmeZfev0O1m1kc6knjeaOPYhCFK/WyoZ:kcv8F2Wa8ukNeZmcORc9n3rwK/BoZ

Score

9^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  RUT V3.exe
- Size
  
  10.6MB
- MD5
  
  a77c3c4678f20357d92bf98a5aa8979d
- SHA1
  
  1c1dbc0b54b20844e0b2ed1f4877bdcd6e062081
- SHA256
  
  5db7e3cba3a56ea7265ac824f5b3bd64853e42c4fa9eb8a5e706bcad5acdff0e
- SHA512
  
  d896a03e3d3fc4f28cc07b718e289350b87fbd896bdf3fd487bfb3686afe4c35dd87cbe519cdb9b352c5426ae5c17733f106b8c1a7176a8e5cf85597b6af35f8
- SSDEEP
  
  196608:2tz+SDWS8v80ix2Wa88Vb6FN20vmtmeZfev0O1m1kc6knjeaOPYhCFK/WyoZ:kcv8F2Wa8ukNeZmcORc9n3rwK/BoZ
Score

9^/10

discovery evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan