0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2

Resubmissions

15/05/2024, 13:04

240515-qaxzcaaf5w

09/04/2024, 15:48

09/04/2024, 15:36

09/04/2024, 15:19

09/04/2024, 14:52

09/04/2024, 14:39

Sharing

Copy URL Twitter E-mail

General

Target
WaveTrial.rar
Size 156.4MB
Sample240409-sp9ykadh91
SHA256 0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2
MD5 0159c8632597db4afc30105f24cdd3ea
SHA1 5e80272c6ff0d820cdb0a4f98f7fbf0d558f5957
SHA512 587e4dc7ae21036f3aaec3e99955670ef0c457fab23db79b71f0963acc79a1f2eca61b2233b6770672a139b0f8a9ae98ad65bed2431aac476fe7d4e293e666fe
SSDEEP 3145728:GeUQUfKvWr13d8VZDUdp27PkF5oeUahBcPVyMVob2395nOl0tUD:MKuh+DU72TkF5oeVBMX3nnptUD
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  WaveTrial.rar
- Size 156.4MB
- SHA256 0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2
- MD5 0159c8632597db4afc30105f24cdd3ea
- SHA1 5e80272c6ff0d820cdb0a4f98f7fbf0d558f5957
- SHA512 587e4dc7ae21036f3aaec3e99955670ef0c457fab23db79b71f0963acc79a1f2eca61b2233b6770672a139b0f8a9ae98ad65bed2431aac476fe7d4e293e666fe
- SSDEEP 3145728:GeUQUfKvWr13d8VZDUdp27PkF5oeUahBcPVyMVob2395nOl0tUD:MKuh+DU72TkF5oeVBMX3nnptUD
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2
- Target
  WaveTrial/Injector.exe
- Size 3.4MB
- SHA256 443b665c5f545a2bdd7855f86bf70a5ee7f35eda1b6b08615161f5809cbda02b
- MD5 c6b39ee166d5b0a2c8a9021ccd1593ae
- SHA1 e480e7c282f64e8b0179c82afe154dd59d14217d
- SHA512 3864aea36c522ca5658412128e6a4c862a647cf3b1054b9adbe418488590a37600d7639c3eba94ca9de76f087b244b95644c667213b1122889cf2d9b7a4652d2
- SSDEEP 49152:Kl0nJ28J4VZohYWVGGjW8NhSU7zwo8oXJ2R3KPHsI7coj2J+eNgRpqNc1a:KmnJrJ4DohYWVTJNkIZZ2R6vsmA+FDqN
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  WaveTrial/Wave.exe
- Size 7.0MB
- SHA256 2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
- MD5 a8bd4a6b2f1d00928e61870a5688c13d
- SHA1 e17646d5279534f2e3eb0e0cfc8b6c536bc0c095
- SHA512 6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb
- SSDEEP 98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6