0cdb7065b5a3c8dd36eaa42969722cbfe295d7a9366f63c9acd9bc17cd90a182 | Triage

Sharing

General

Target

mesquita_protected.exe
Size

11.3MB
Sample

230708-z4e53aba71
MD5

e5c8cb67b695bb7d8caa6c7884ee9f13
SHA1

c99997e430a38fc9101b1fa311e6a6022f4bed6b
SHA256

0cdb7065b5a3c8dd36eaa42969722cbfe295d7a9366f63c9acd9bc17cd90a182
SHA512

c012511b396f7ce3283e48209c260007569b20c4bae50df17f4d0c1a8e4425d6fd9ad3447f56e52b02af5339343466c131d38b0b363d5ffdbdee8952296385e3
SSDEEP

196608:5TMleb5lnNaJA7xIzIBnr8QTGrDtB7wCiBMJZj+oSpGgSIkQKgAPu1Ft:trbrnQJAFIzIB9G9iFMf+oSkgBL1

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  mesquita_protected.exe
- Size
  
  11.3MB
- MD5
  
  e5c8cb67b695bb7d8caa6c7884ee9f13
- SHA1
  
  c99997e430a38fc9101b1fa311e6a6022f4bed6b
- SHA256
  
  0cdb7065b5a3c8dd36eaa42969722cbfe295d7a9366f63c9acd9bc17cd90a182
- SHA512
  
  c012511b396f7ce3283e48209c260007569b20c4bae50df17f4d0c1a8e4425d6fd9ad3447f56e52b02af5339343466c131d38b0b363d5ffdbdee8952296385e3
- SSDEEP
  
  196608:5TMleb5lnNaJA7xIzIBnr8QTGrDtB7wCiBMJZj+oSpGgSIkQKgAPu1Ft:trbrnQJAFIzIB9G9iFMf+oSkgBL1
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2