Overview

overview

9

Static

static

3

testbuild.exe

windows7-x64

5

testbuild.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    testbuild.exe

  • Size

    14.8MB

  • Sample

    231104-a89g2abd9x

  • MD5

    a1873517aaf68a0c1cb6a9e89752cdb5

  • SHA1

    a23b3b6246350a0b784c4b3f9c60b1fc23c102c3

  • SHA256

    8c125c245ed5bb288adf20e979672c3130d292bb66a9832108b986dec6eb691f

  • SHA512

    ba3fa182456b8dfda46eab7d44bdfb99d8d3b0eb86d6e0cdf602b29e3ee5cc9997ddb4515d1d95d98afa777a3737df7a5479e526332cfea9065f20e9fab5c467

  • SSDEEP

    393216:bLXXPrtznC15ydfNZMdWEOP6DmtqgXcAetKDbd80:b3A3CfNZMdWEFDtgXmQ7

Score
9/10
evasion

Malware Config

Targets

    • Target

      testbuild.exe

    • Size

      14.8MB

    • MD5

      a1873517aaf68a0c1cb6a9e89752cdb5

    • SHA1

      a23b3b6246350a0b784c4b3f9c60b1fc23c102c3

    • SHA256

      8c125c245ed5bb288adf20e979672c3130d292bb66a9832108b986dec6eb691f

    • SHA512

      ba3fa182456b8dfda46eab7d44bdfb99d8d3b0eb86d6e0cdf602b29e3ee5cc9997ddb4515d1d95d98afa777a3737df7a5479e526332cfea9065f20e9fab5c467

    • SSDEEP

      393216:bLXXPrtznC15ydfNZMdWEOP6DmtqgXcAetKDbd80:b3A3CfNZMdWEFDtgXmQ7

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks