General

  • Target

    e9fa366f1628ad8dd7838a846015d14c5539a0a20f2489f288621d172f751cd6

  • Size

    6.3MB

  • Sample

    240526-d7w24ade5v

  • MD5

    c4fc9ffee048e89af06177320fe31cfd

  • SHA1

    b2160ff9370544555039667879a98a9c2b0817fd

  • SHA256

    e9fa366f1628ad8dd7838a846015d14c5539a0a20f2489f288621d172f751cd6

  • SHA512

    c0b1342b0d11a2092f612745db29471a868635f43556cd97ce08fd56b5114fb48c8b47cf7526fe3f62f391441f32291565af0b167113c3d90221d5bcc2e111f1

  • SSDEEP

    196608:cO+lohu/cpCNn3qCKqyI0JJguZQWVA/a6fmhX4:cO+lohuECsjqyIfu2/78X4

Malware Config

Targets

    • Target

      e9fa366f1628ad8dd7838a846015d14c5539a0a20f2489f288621d172f751cd6

    • Size

      6.3MB

    • MD5

      c4fc9ffee048e89af06177320fe31cfd

    • SHA1

      b2160ff9370544555039667879a98a9c2b0817fd

    • SHA256

      e9fa366f1628ad8dd7838a846015d14c5539a0a20f2489f288621d172f751cd6

    • SHA512

      c0b1342b0d11a2092f612745db29471a868635f43556cd97ce08fd56b5114fb48c8b47cf7526fe3f62f391441f32291565af0b167113c3d90221d5bcc2e111f1

    • SSDEEP

      196608:cO+lohu/cpCNn3qCKqyI0JJguZQWVA/a6fmhX4:cO+lohuECsjqyIfu2/78X4

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Tasks