5ee4b79cc212e0599a577c2e95863f38c97ceb60ad517e2acd73050b4e294d94 | Triage

Sharing

General

Target

5ee4b79cc212e0599a577c2e95863f38c97ceb60ad517e2acd73050b4e294d94
Size

2.4MB
Sample

240524-ffe1lsdh9t
MD5

bfd332b18e0039c9b56617cc3b544ba7
SHA1

51aef7ee987d3e43262a592fd834a67b118019bf
SHA256

5ee4b79cc212e0599a577c2e95863f38c97ceb60ad517e2acd73050b4e294d94
SHA512

cf3c5f2eddefc2a1d181755087eb274f3173b82fd65dd3b40f47517fa3ab070e15f55208683f56f6647f1f28809c5ab3f1fb6bd46da6add3bf1f6cc4fcc40e7a
SSDEEP

49152:oR+lohNPxhHAitoyJfgQMh6Me9jdPMvYq8rY+4Z59bZKmNJic:X+AihJoQMgjlMvYq8rQ5ZZTic

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  5ee4b79cc212e0599a577c2e95863f38c97ceb60ad517e2acd73050b4e294d94
- Size
  
  2.4MB
- MD5
  
  bfd332b18e0039c9b56617cc3b544ba7
- SHA1
  
  51aef7ee987d3e43262a592fd834a67b118019bf
- SHA256
  
  5ee4b79cc212e0599a577c2e95863f38c97ceb60ad517e2acd73050b4e294d94
- SHA512
  
  cf3c5f2eddefc2a1d181755087eb274f3173b82fd65dd3b40f47517fa3ab070e15f55208683f56f6647f1f28809c5ab3f1fb6bd46da6add3bf1f6cc4fcc40e7a
- SSDEEP
  
  49152:oR+lohNPxhHAitoyJfgQMh6Me9jdPMvYq8rY+4Z59bZKmNJic:X+AihJoQMgjlMvYq8rQ5ZZTic
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2