Overview

overview

9

Static

static

3

mueof.dll

windows7-x64

9

mueof.dll

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    074b2a20db573f5c73a029d9ab855471

  • Size

    1.1MB

  • Sample

    231224-vlwmwahba6

  • MD5

    074b2a20db573f5c73a029d9ab855471

  • SHA1

    3c24a789b3bad90935ad1341812c89787b76a0a5

  • SHA256

    7eace30c969bd920da2b201ff8987bebde05b2ce6dcfcd750ab8c31ab1fb8922

  • SHA512

    de604ae40c4b60ef30088f2546ce6b715c07746ba7c2daafb3a97c4838c7d59f18eec7ede2f6b8ebc47244e351ada004245c9b71c4d57722faeaf1c534ded42f

  • SSDEEP

    24576:EOm4BzQSOZD42bzihY0BUnWRI5o6Ejz9JcfJZPUT:BBmDVbONwWMo6EjsfzQ

Score
9/10
evasion

Malware Config

Targets

    • Target

      mueof.dll

    • Size

      1.1MB

    • MD5

      e9dfb316945334fd7b03db77760568c2

    • SHA1

      45d709acf9f4dce6a89a6a11180bac46cb5cc474

    • SHA256

      818774d718b0dda0aa2c864d4339494e0336e48d2f40af5adb6c8eb7baa38a80

    • SHA512

      c9a2b61e01915a826c002fc7e054268d383135ff156d7caa4e81f1a86a12f01b3015084101516baffa157f36970518c0246b8803e3770471dcb17b65cbe07b3a

    • SSDEEP

      24576:Xm4RbAMO33kEjFM/jUeg2HSVcOadw74ljxdg3SJEgh/WdIF:zRG35GTg29+4hoCJyyF

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks