General

  • Target

    29f003a446960afbdfa41627103f8d1280d422ff7444efb1de0e0a6265a85311

  • Size

    3.4MB

  • Sample

    240614-x265nawgrl

  • MD5

    5802280eca5e20a43e17d62323b7ee2d

  • SHA1

    846c93bb429bfefbb272cea0efa1dfaa3870b56e

  • SHA256

    29f003a446960afbdfa41627103f8d1280d422ff7444efb1de0e0a6265a85311

  • SHA512

    77077e1004b5d5016ebf2459e8ff928c0830821d5d7164ec898b397152f0d901dce05eb6174b71815ef1b834294b71484daf1694da2d9d604e0336a7a5d0bd2d

  • SSDEEP

    98304:ZwciVlmB/yJM/yyzv1//VtzhG2rz8/9YHZz/N:ZwROyJqrvFEw4u5Z

Malware Config

Targets

    • Target

      29f003a446960afbdfa41627103f8d1280d422ff7444efb1de0e0a6265a85311

    • Size

      3.4MB

    • MD5

      5802280eca5e20a43e17d62323b7ee2d

    • SHA1

      846c93bb429bfefbb272cea0efa1dfaa3870b56e

    • SHA256

      29f003a446960afbdfa41627103f8d1280d422ff7444efb1de0e0a6265a85311

    • SHA512

      77077e1004b5d5016ebf2459e8ff928c0830821d5d7164ec898b397152f0d901dce05eb6174b71815ef1b834294b71484daf1694da2d9d604e0336a7a5d0bd2d

    • SSDEEP

      98304:ZwciVlmB/yJM/yyzv1//VtzhG2rz8/9YHZz/N:ZwROyJqrvFEw4u5Z

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Tasks