773e809ac4a9f0279eb2c258cb77288b14550b4e7ff646a9d82d888d11e6e225 | Triage

Sharing

General

Target

c5f9d9794e1cf3f40ef45f0e2a0ced13
Size

428KB
Sample

240313-qlvclafe43
MD5

c5f9d9794e1cf3f40ef45f0e2a0ced13
SHA1

b23a6498477ef463837382312512fe6254997155
SHA256

773e809ac4a9f0279eb2c258cb77288b14550b4e7ff646a9d82d888d11e6e225
SHA512

058f7f5e5ccb4d75014da8251291748013be87b71e0c443bd5e8da83754f77ba8b999bef0ba55d36f6dcbcd07ea7a1e22dd9d253223dc7319f3179403bba73bd
SSDEEP

12288:b9ZRLce1FpBL/Yf60nJRV57oTnbRpx3Qz:bDFLvph/YfZJv5cTn1

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  c5f9d9794e1cf3f40ef45f0e2a0ced13
- Size
  
  428KB
- MD5
  
  c5f9d9794e1cf3f40ef45f0e2a0ced13
- SHA1
  
  b23a6498477ef463837382312512fe6254997155
- SHA256
  
  773e809ac4a9f0279eb2c258cb77288b14550b4e7ff646a9d82d888d11e6e225
- SHA512
  
  058f7f5e5ccb4d75014da8251291748013be87b71e0c443bd5e8da83754f77ba8b999bef0ba55d36f6dcbcd07ea7a1e22dd9d253223dc7319f3179403bba73bd
- SSDEEP
  
  12288:b9ZRLce1FpBL/Yf60nJRV57oTnbRpx3Qz:bDFLvph/YfZJv5cTn1
Score

10^/10

evasion trojan
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Looks for VMWare Tools registry key
  evasion
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2