ploutus

General

Target

7a460e4fb8f9c66685dd430e06d40f15a1bbdf6d7886ebde2cdf99bfa0c59d86
Size

7.1MB
Sample

240229-lnnwdach5t
MD5

e019295a44882db3321c692f7d818b8b
SHA1

2c5f371ac5db8062b876571d20398c60b0b0f584
SHA256

7a460e4fb8f9c66685dd430e06d40f15a1bbdf6d7886ebde2cdf99bfa0c59d86
SHA512

002fb6d60a3c8874c7e257cdb174928cd908223bc3fb553cd9fd6506bfc91b6cb45fdc2909fb069fad9b4a75fefbde3addeacc444bc76f25e47fe560925be4e6
SSDEEP

98304:hwdhBkGMb188jaz+2RYKNpYzp5jsvYjJ+tSfby2N/lZU5V1FXwOoopC+2UOZ:f88Oz8hro8+tkt/lZaloopC+

Score

10^/10

Malware Config

Targets

- Target
  
  7a460e4fb8f9c66685dd430e06d40f15a1bbdf6d7886ebde2cdf99bfa0c59d86
- Size
  
  7.1MB
- MD5
  
  e019295a44882db3321c692f7d818b8b
- SHA1
  
  2c5f371ac5db8062b876571d20398c60b0b0f584
- SHA256
  
  7a460e4fb8f9c66685dd430e06d40f15a1bbdf6d7886ebde2cdf99bfa0c59d86
- SHA512
  
  002fb6d60a3c8874c7e257cdb174928cd908223bc3fb553cd9fd6506bfc91b6cb45fdc2909fb069fad9b4a75fefbde3addeacc444bc76f25e47fe560925be4e6
- SSDEEP
  
  98304:hwdhBkGMb188jaz+2RYKNpYzp5jsvYjJ+tSfby2N/lZU5V1FXwOoopC+2UOZ:f88Oz8hro8+tkt/lZaloopC+
Score

10^/10

ploutus atm backdoor evasion
- Detected Ploutus loader
- Ploutus
  Ploutus is an ATM malware written in C#.
  backdoor atm ploutus
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Ploutus loader

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2