Resubmissions

06/02/2025, 13:55

250206-q8gp1swqfz 9

28/04/2024, 20:26

240428-y7w3bagc94 9

General

  • Target

    AtXtpwIJyQWWufbN.exe

  • Size

    14.2MB

  • Sample

    240428-y7w3bagc94

  • MD5

    00a57273989a40b1757b890c80c8a92a

  • SHA1

    59a68061603d9e14e8f7b850329ea675ee417062

  • SHA256

    7b9e81cf36ee3fb1224156663a138fc6a279a5ae61e53f59a413b3e825b9c1df

  • SHA512

    d9a962e6ec98f76ad159d64f1e8351729565aa7445f4cc181bd13607ba57d2019dec5ff2f3d3d6b5f46299a14b714705eeeec5c6f1515e6ef3cc0d2946c6690b

  • SSDEEP

    393216:WYJ5Qt9iFsm7tzozxGMJbGVGcZcT+FaJFAorO:WYwKFBCzgM0LAkSO

Malware Config

Targets

    • Target

      AtXtpwIJyQWWufbN.exe

    • Size

      14.2MB

    • MD5

      00a57273989a40b1757b890c80c8a92a

    • SHA1

      59a68061603d9e14e8f7b850329ea675ee417062

    • SHA256

      7b9e81cf36ee3fb1224156663a138fc6a279a5ae61e53f59a413b3e825b9c1df

    • SHA512

      d9a962e6ec98f76ad159d64f1e8351729565aa7445f4cc181bd13607ba57d2019dec5ff2f3d3d6b5f46299a14b714705eeeec5c6f1515e6ef3cc0d2946c6690b

    • SSDEEP

      393216:WYJ5Qt9iFsm7tzozxGMJbGVGcZcT+FaJFAorO:WYwKFBCzgM0LAkSO

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks