Overview

overview

9

Static

static

3

add0697122...11.exe

windows7-x64

9

add0697122...11.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    add069712276fe43896101b679b8c9acc919f73b1cf8c9756701a34f8d3cf311

  • Size

    3.3MB

  • Sample

    240508-dtcfjaad79

  • MD5

    5c10275d75632086369da03b307b9551

  • SHA1

    3b784a1cfb18c053dce9d5eaad3077a345620855

  • SHA256

    add069712276fe43896101b679b8c9acc919f73b1cf8c9756701a34f8d3cf311

  • SHA512

    8bb2320ddcc0eec215143d2108be6739ac64a11a80d0e677f89438b037c2621d9c8459189d5aa1a0d79ff23965fbf08fbc4c76715f98d4e87cf8e0a038d08fb0

  • SSDEEP

    49152:+NDHUSUCshanU38MOrmWkVXY6PXIC1k4g7PAdIvtmM6URuBfllqxR:+NDHUoUjOKhXY6P4wBgTgZi

Score
9/10
evasion

Malware Config

Targets

    • Target

      add069712276fe43896101b679b8c9acc919f73b1cf8c9756701a34f8d3cf311

    • Size

      3.3MB

    • MD5

      5c10275d75632086369da03b307b9551

    • SHA1

      3b784a1cfb18c053dce9d5eaad3077a345620855

    • SHA256

      add069712276fe43896101b679b8c9acc919f73b1cf8c9756701a34f8d3cf311

    • SHA512

      8bb2320ddcc0eec215143d2108be6739ac64a11a80d0e677f89438b037c2621d9c8459189d5aa1a0d79ff23965fbf08fbc4c76715f98d4e87cf8e0a038d08fb0

    • SSDEEP

      49152:+NDHUSUCshanU38MOrmWkVXY6PXIC1k4g7PAdIvtmM6URuBfllqxR:+NDHUoUjOKhXY6P4wBgTgZi

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks