dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907 | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.MulDrop24.24081.4037.18647.exe
Size

15.0MB
Sample

240315-h4ze9scg73
MD5

b985d74ccba3ed0f00afe786ac80aa26
SHA1

25e7caabc7317298745fc890e92fdc69b7d44250
SHA256

dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907
SHA512

fd81949cb129bf021f2048135b4994b9fb83be41b726164af43d4620ab1af55ecb070d24ef54c7eda79f8f255d221d43ef798e3b5fa41c65d0452a530975ec1c
SSDEEP

196608:v4Zrv/uL7NJhKX63JWmQYeCMuXhR3Jn98y18qUq9k/IAj4qTNMGB1vlgJGaoGiPZ:v41/udJoX63JLQA33EqUuO4qBgJxiB

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Trojan.MulDrop24.24081.4037.18647.exe
- Size
  
  15.0MB
- MD5
  
  b985d74ccba3ed0f00afe786ac80aa26
- SHA1
  
  25e7caabc7317298745fc890e92fdc69b7d44250
- SHA256
  
  dc1c64d12202fce25f4c346619517c60134aad6a3dfeb6ec09c913716a9e9907
- SHA512
  
  fd81949cb129bf021f2048135b4994b9fb83be41b726164af43d4620ab1af55ecb070d24ef54c7eda79f8f255d221d43ef798e3b5fa41c65d0452a530975ec1c
- SSDEEP
  
  196608:v4Zrv/uL7NJhKX63JWmQYeCMuXhR3Jn98y18qUq9k/IAj4qTNMGB1vlgJGaoGiPZ:v41/udJoX63JLQA33EqUuO4qBgJxiB
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2