f5c0447663b7667c2106c72fdaf44055f25ce26d826b68198a666d8a10d979b3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b81d31bf4baf7ab5f90f15a0632c6814
Size

975KB
Sample

240306-y98twshf5z
MD5

b81d31bf4baf7ab5f90f15a0632c6814
SHA1

a0cb5c8692cc0b69b1997da8bc4b6ca3dec7f807
SHA256

f5c0447663b7667c2106c72fdaf44055f25ce26d826b68198a666d8a10d979b3
SHA512

aa9e6d70662c89ffce9e0fbfe5190fd3ea23421c3fabc26240cdc693eba71ecdd4aa50e1f2c145cf205915c77a37a3db3442cb8be3b60a872a5f589e945f894f
SSDEEP

12288:Aw+bMncsUGXOuccWWPVycWsNOKpVNFLBhTmrps+3y:Aw5ncxhuccddycXbNVsBy

Score

7^/10

evasion

Malware Config

Targets

- Target
  
  b81d31bf4baf7ab5f90f15a0632c6814
- Size
  
  975KB
- MD5
  
  b81d31bf4baf7ab5f90f15a0632c6814
- SHA1
  
  a0cb5c8692cc0b69b1997da8bc4b6ca3dec7f807
- SHA256
  
  f5c0447663b7667c2106c72fdaf44055f25ce26d826b68198a666d8a10d979b3
- SHA512
  
  aa9e6d70662c89ffce9e0fbfe5190fd3ea23421c3fabc26240cdc693eba71ecdd4aa50e1f2c145cf205915c77a37a3db3442cb8be3b60a872a5f589e945f894f
- SSDEEP
  
  12288:Aw+bMncsUGXOuccWWPVycWsNOKpVNFLBhTmrps+3y:Aw5ncxhuccddycXbNVsBy
Score

7^/10

evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2