Overview

overview

9

Static

static

1

malware.msi

windows10-1703-x64

9

malware.msi

windows7-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    malware.msi

  • Size

    2.7MB

  • Sample

    230607-gqvz9aha43

  • MD5

    28b7b86f7322b461eab649cba09b1fc4

  • SHA1

    b7e5ca54d120f28519c6585f6591f64850d0392e

  • SHA256

    2fbe064a03b7d8c096be249273047adfe277180543bbc72f9f0a65be5e3a42eb

  • SHA512

    8e6d6ce5efec0c25af0cc4e309e02e18c8f8aa5f3bad9de1ba2a3ed39af8d4f7350e1f47b7b9bcb1339232cb3796ada546608bc52aa9de65cabd5228825a229f

  • SSDEEP

    49152:FW9Y5AiEUl8Vlvf3/fQhksQQNgXAo1sVzhly+PkfsJJ10FRzVThJUzKjVqYSW38O:4Y5AiEkufs01sVNUjVqYSW38jDW

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      malware.msi

    • Size

      2.7MB

    • MD5

      28b7b86f7322b461eab649cba09b1fc4

    • SHA1

      b7e5ca54d120f28519c6585f6591f64850d0392e

    • SHA256

      2fbe064a03b7d8c096be249273047adfe277180543bbc72f9f0a65be5e3a42eb

    • SHA512

      8e6d6ce5efec0c25af0cc4e309e02e18c8f8aa5f3bad9de1ba2a3ed39af8d4f7350e1f47b7b9bcb1339232cb3796ada546608bc52aa9de65cabd5228825a229f

    • SSDEEP

      49152:FW9Y5AiEUl8Vlvf3/fQhksQQNgXAo1sVzhly+PkfsJJ10FRzVThJUzKjVqYSW38O:4Y5AiEkufs01sVNUjVqYSW38jDW

    Score
    9/10
    evasionpersistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks