General

  • Target

    eaf59fdec51eed063096dd1d013fe81724d8ca97d69af416bf4fc14a17bffc60

  • Size

    15.1MB

  • Sample

    240523-csb8psae69

  • MD5

    1f470c81a3ce621afd7a2cdc227e1257

  • SHA1

    967fb1575a15192cd63c1a060ca5d2c536877309

  • SHA256

    eaf59fdec51eed063096dd1d013fe81724d8ca97d69af416bf4fc14a17bffc60

  • SHA512

    c3856079f529f017ebbe8d1d010e3b8209c2af3fb377a45ccefad4ae33971d6af310035bafd35694514db9d6569a988e0a509d8c0efe79cf064c8589f9465f3e

  • SSDEEP

    393216:dbKAn1QsCuCtot4YZRN8K1qqJLRL1Tt2/x0D4QwGy:MArCuCCi5zSDTt2JUfwB

Malware Config

Targets

    • Target

      eaf59fdec51eed063096dd1d013fe81724d8ca97d69af416bf4fc14a17bffc60

    • Size

      15.1MB

    • MD5

      1f470c81a3ce621afd7a2cdc227e1257

    • SHA1

      967fb1575a15192cd63c1a060ca5d2c536877309

    • SHA256

      eaf59fdec51eed063096dd1d013fe81724d8ca97d69af416bf4fc14a17bffc60

    • SHA512

      c3856079f529f017ebbe8d1d010e3b8209c2af3fb377a45ccefad4ae33971d6af310035bafd35694514db9d6569a988e0a509d8c0efe79cf064c8589f9465f3e

    • SSDEEP

      393216:dbKAn1QsCuCtot4YZRN8K1qqJLRL1Tt2/x0D4QwGy:MArCuCCi5zSDTt2JUfwB

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Tasks