54e4c48cc9e5dc7f3081651020cf88526bce02fc8df2312feaee1f599cf5c2a0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

98ac62886ac6ee7c52218c183680e2f8
Size

4.3MB
Sample

240213-gwqmqaah3s
MD5

98ac62886ac6ee7c52218c183680e2f8
SHA1

f0e7bee784acb38bcdd5ccf74c871b9513559dc5
SHA256

54e4c48cc9e5dc7f3081651020cf88526bce02fc8df2312feaee1f599cf5c2a0
SHA512

ad5b711709aa688c2ec2da07bbe4e7e1b282ac061a572ba4ec49964e19b6814054cfe87c0cd36b513f4470599445868acb31f46262f24154e16842e366396f46
SSDEEP

98304:xbs1iz6tmT8cXKYNJMpWj6k+FkNGm8WY:eM8mT8caYNf6iNGm8W

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  98ac62886ac6ee7c52218c183680e2f8
- Size
  
  4.3MB
- MD5
  
  98ac62886ac6ee7c52218c183680e2f8
- SHA1
  
  f0e7bee784acb38bcdd5ccf74c871b9513559dc5
- SHA256
  
  54e4c48cc9e5dc7f3081651020cf88526bce02fc8df2312feaee1f599cf5c2a0
- SHA512
  
  ad5b711709aa688c2ec2da07bbe4e7e1b282ac061a572ba4ec49964e19b6814054cfe87c0cd36b513f4470599445868acb31f46262f24154e16842e366396f46
- SSDEEP
  
  98304:xbs1iz6tmT8cXKYNJMpWj6k+FkNGm8WY:eM8mT8caYNf6iNGm8W
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2