Overview

overview

9

Static

static

3

1835631eb6...9d.exe

windows7-x64

9

1835631eb6...9d.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1835631eb68dbd1c381cbd529d905e9d

  • Size

    3.6MB

  • Sample

    231230-pe1elafbcm

  • MD5

    1835631eb68dbd1c381cbd529d905e9d

  • SHA1

    ce648af696fda947c000e4ff4ed42275c4bfc739

  • SHA256

    69935b8bfd987db18e288f6cff43025dd0a8bb1eb27f5b6680f8ba2d623f2f41

  • SHA512

    2c4bea4262fd03b1e32c46c61d4e7b9ece5d9c7e908b97b55f2ef3655da33f35d5a46ef45394d302fd0e9a3a948f1ce676dd074558a2130f86116a01e55ac4b7

  • SSDEEP

    98304:8Mud3bhw4eD82hfeD4fhloc7CiZPCD7/94sTC:8Rrm4ew2Uyzoc7x6dG

Score
9/10
evasion

Malware Config

Targets

    • Target

      1835631eb68dbd1c381cbd529d905e9d

    • Size

      3.6MB

    • MD5

      1835631eb68dbd1c381cbd529d905e9d

    • SHA1

      ce648af696fda947c000e4ff4ed42275c4bfc739

    • SHA256

      69935b8bfd987db18e288f6cff43025dd0a8bb1eb27f5b6680f8ba2d623f2f41

    • SHA512

      2c4bea4262fd03b1e32c46c61d4e7b9ece5d9c7e908b97b55f2ef3655da33f35d5a46ef45394d302fd0e9a3a948f1ce676dd074558a2130f86116a01e55ac4b7

    • SSDEEP

      98304:8Mud3bhw4eD82hfeD4fhloc7CiZPCD7/94sTC:8Rrm4ew2Uyzoc7x6dG

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks