Overview

overview

9

Static

static

3

8c83c4a0a7...4e.exe

windows7-x64

9

8c83c4a0a7...4e.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    8c83c4a0a7f91ce8549c1a642609b5a075b19c4e407c7e3c1ff71f162429ca4e

  • Size

    5.5MB

  • Sample

    231011-abrkyshb6s

  • MD5

    4a18ad0d94a31d1f5777029df0064628

  • SHA1

    adac9dbf847b3015a7e7ce6209aa03b52b559674

  • SHA256

    8c83c4a0a7f91ce8549c1a642609b5a075b19c4e407c7e3c1ff71f162429ca4e

  • SHA512

    203686207ad3c07fde12b046a37368b532a8c9931e66f20c350c9436a398bc87f2d2d4354538547ce03aa2976a758403e6cef595d1df90d22301eeb50047c9ab

  • SSDEEP

    98304:V0NfzLZf3LExX7GSGxuWs7ChvypEnsHXHtRjWlyltprXyDO13GpX3of3m3H:GLJbExiSGEWs79EnsXtXXyi1WpX3q32

Score
9/10
evasiontrojan

Malware Config

Targets

    • Target

      8c83c4a0a7f91ce8549c1a642609b5a075b19c4e407c7e3c1ff71f162429ca4e

    • Size

      5.5MB

    • MD5

      4a18ad0d94a31d1f5777029df0064628

    • SHA1

      adac9dbf847b3015a7e7ce6209aa03b52b559674

    • SHA256

      8c83c4a0a7f91ce8549c1a642609b5a075b19c4e407c7e3c1ff71f162429ca4e

    • SHA512

      203686207ad3c07fde12b046a37368b532a8c9931e66f20c350c9436a398bc87f2d2d4354538547ce03aa2976a758403e6cef595d1df90d22301eeb50047c9ab

    • SSDEEP

      98304:V0NfzLZf3LExX7GSGxuWs7ChvypEnsHXHtRjWlyltprXyDO13GpX3of3m3H:GLJbExiSGEWs79EnsXtXXyi1WpX3q32

    Score
    9/10
    evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks