General

  • Target

    6cd588d0515be40fa37b5a09a288682f

  • Size

    214KB

  • Sample

    231226-n62lasgeaj

  • MD5

    6cd588d0515be40fa37b5a09a288682f

  • SHA1

    630aa3f99a394ce2d1f1aa95d4e76100a61b2f4e

  • SHA256

    497fcfe8d44cf501dc57628ac10bee0b11062abd358690a441773dec8b1a72eb

  • SHA512

    b253166e315e1b27dca64d2c378498b7ba4389507332f80492d95e2c2a0dd0b6793f92978a7814951db6827b71d2d3a4fc17504ba03248bcfe401c9f29de4699

  • SSDEEP

    6144:uL38YSBhz9vFjw93+xmcg3VHglNX2NNNyWkEg:uL38Y+99vFjw93+YlAPmN5Zg

Score
9/10

Malware Config

Targets

    • Target

      6cd588d0515be40fa37b5a09a288682f

    • Size

      214KB

    • MD5

      6cd588d0515be40fa37b5a09a288682f

    • SHA1

      630aa3f99a394ce2d1f1aa95d4e76100a61b2f4e

    • SHA256

      497fcfe8d44cf501dc57628ac10bee0b11062abd358690a441773dec8b1a72eb

    • SHA512

      b253166e315e1b27dca64d2c378498b7ba4389507332f80492d95e2c2a0dd0b6793f92978a7814951db6827b71d2d3a4fc17504ba03248bcfe401c9f29de4699

    • SSDEEP

      6144:uL38YSBhz9vFjw93+xmcg3VHglNX2NNNyWkEg:uL38Y+99vFjw93+YlAPmN5Zg

    Score
    9/10
    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks