a3a33ea371114c9cb4e483829520ac7e5b2686ded399c019c9b20df2dd65b505 | Triage

Sharing

General

Target

8c657cdaeb25025153e52777590996e2
Size

1.6MB
Sample

240203-qbqawshhf9
MD5

8c657cdaeb25025153e52777590996e2
SHA1

3d64bbc4f111d29752a1806ceebcdc26ede68e69
SHA256

a3a33ea371114c9cb4e483829520ac7e5b2686ded399c019c9b20df2dd65b505
SHA512

e9be59baa96e6999aab4f838f22650a1243dcd4052b6680b60c32dc2f51959e92eda9026fd151e62e6bd6444d6e03ac01a53ebde4106ae215a12fd1a2b42c6fe
SSDEEP

49152:/4nBO1JWkYDKsBeVpUpU6MUtygJyasJIwJaxSk2Z:QQ1zYXIVL6MU/Hw0xSk2Z

Score

7^/10

evasion

Malware Config

Targets

- Target
  
  8c657cdaeb25025153e52777590996e2
- Size
  
  1.6MB
- MD5
  
  8c657cdaeb25025153e52777590996e2
- SHA1
  
  3d64bbc4f111d29752a1806ceebcdc26ede68e69
- SHA256
  
  a3a33ea371114c9cb4e483829520ac7e5b2686ded399c019c9b20df2dd65b505
- SHA512
  
  e9be59baa96e6999aab4f838f22650a1243dcd4052b6680b60c32dc2f51959e92eda9026fd151e62e6bd6444d6e03ac01a53ebde4106ae215a12fd1a2b42c6fe
- SSDEEP
  
  49152:/4nBO1JWkYDKsBeVpUpU6MUtygJyasJIwJaxSk2Z:QQ1zYXIVL6MU/Hw0xSk2Z
Score

7^/10

evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2