117e7cdc8491eba6588615ccb8db33f55614756f578a4184ceb4e1fff8053fb5 | Triage

Sharing

General

Target

tmp
Size

880KB
Sample

231012-g6bljseb69
MD5

008dac3978cdbc52876ac57ff9f1011f
SHA1

3aec6ccd010d5e1cfdd01dba02010cb6d6c3a422
SHA256

117e7cdc8491eba6588615ccb8db33f55614756f578a4184ceb4e1fff8053fb5
SHA512

8e8d496d4ef3a68494056d052425cdb5197e44defa74412fece316ec7a9a003a6b9cec34e721c428c7a283009e88c21e47946a4bbdb8e64cfc80f7a6557cf28c
SSDEEP

24576:eq7JcjVu4zYnk2wHpdmlKB99NDpKGN/VcUNy:V7urYntwHvBWGNNNy

Score

7^/10

Malware Config

Targets

- Target
  
  tmp
- Size
  
  880KB
- MD5
  
  008dac3978cdbc52876ac57ff9f1011f
- SHA1
  
  3aec6ccd010d5e1cfdd01dba02010cb6d6c3a422
- SHA256
  
  117e7cdc8491eba6588615ccb8db33f55614756f578a4184ceb4e1fff8053fb5
- SHA512
  
  8e8d496d4ef3a68494056d052425cdb5197e44defa74412fece316ec7a9a003a6b9cec34e721c428c7a283009e88c21e47946a4bbdb8e64cfc80f7a6557cf28c
- SSDEEP
  
  24576:eq7JcjVu4zYnk2wHpdmlKB99NDpKGN/VcUNy:V7urYntwHvBWGNNNy
Score

7^/10
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2