126ea53f4c0e9bd647ebcfb71a9a9884bb382221091ee11098a3484a5c6e5aa7 | Triage

Sharing

General

Target

96c6e17e4ce33df38b055d2e5647ee0e
Size

781KB
Sample

240212-kyzj7abb64
MD5

96c6e17e4ce33df38b055d2e5647ee0e
SHA1

3c40f47b0c236a36a4d0ddd5628d6296b32cafed
SHA256

126ea53f4c0e9bd647ebcfb71a9a9884bb382221091ee11098a3484a5c6e5aa7
SHA512

b471d9be9d0218ffdf09fca44040602843bc135ccc1e2c4e369dd6d175b6ffca76c23528c3eaf1781943b664b619db8e8fd6c1e39f58ab8f8c2af1276905a1ac
SSDEEP

24576:Gw8zYt8K8cdDOwJ0UrTJO8EGG4aCXvqjgfgqpe03:izYt8/UOkJO8k4zvq8gXi

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  96c6e17e4ce33df38b055d2e5647ee0e
- Size
  
  781KB
- MD5
  
  96c6e17e4ce33df38b055d2e5647ee0e
- SHA1
  
  3c40f47b0c236a36a4d0ddd5628d6296b32cafed
- SHA256
  
  126ea53f4c0e9bd647ebcfb71a9a9884bb382221091ee11098a3484a5c6e5aa7
- SHA512
  
  b471d9be9d0218ffdf09fca44040602843bc135ccc1e2c4e369dd6d175b6ffca76c23528c3eaf1781943b664b619db8e8fd6c1e39f58ab8f8c2af1276905a1ac
- SSDEEP
  
  24576:Gw8zYt8K8cdDOwJ0UrTJO8EGG4aCXvqjgfgqpe03:izYt8/UOkJO8k4zvq8gXi
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2