ae9f4c94e6ba6bd784e781a1a5a3a5bc25bac1f3149b486045d9348621cc2443 | Triage

Sharing

General

Target

ae9f4c94e6ba6bd784e781a1a5a3a5bc25bac1f3149b486045d9348621cc2443
Size

2.0MB
Sample

240406-b1fqeshc22
MD5

ab275dc085750fcd8255c9c53f4a0cbc
SHA1

e7696576c13fd1710273a11e8aeed9130b4b5b93
SHA256

ae9f4c94e6ba6bd784e781a1a5a3a5bc25bac1f3149b486045d9348621cc2443
SHA512

f3b963cb624bf2ce312ba3a7baba75cee471a42688e9c44217d659b466081be363271c571076ac182fd85d6e160835030dc60004fde4f1941d35d63aa69fb8fa
SSDEEP

49152:RVRgimL5K/33pLBRYC9G+RbbUaTTwOFifiR6wXHRb:vRgWJQl+RbdTDMiR6s

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  ae9f4c94e6ba6bd784e781a1a5a3a5bc25bac1f3149b486045d9348621cc2443
- Size
  
  2.0MB
- MD5
  
  ab275dc085750fcd8255c9c53f4a0cbc
- SHA1
  
  e7696576c13fd1710273a11e8aeed9130b4b5b93
- SHA256
  
  ae9f4c94e6ba6bd784e781a1a5a3a5bc25bac1f3149b486045d9348621cc2443
- SHA512
  
  f3b963cb624bf2ce312ba3a7baba75cee471a42688e9c44217d659b466081be363271c571076ac182fd85d6e160835030dc60004fde4f1941d35d63aa69fb8fa
- SSDEEP
  
  49152:RVRgimL5K/33pLBRYC9G+RbbUaTTwOFifiR6wXHRb:vRgWJQl+RbdTDMiR6s
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2