Overview

overview

9

Static

static

3

8e865d5adf...b8.exe

windows7-x64

9

8e865d5adf...b8.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8

  • Size

    3.7MB

  • Sample

    240630-1crkfswdna

  • MD5

    6f53e94dbd37e017301aa544a8c182a5

  • SHA1

    b1d3cc7b0e5b6b8b08f98e48231a7779bd1a6c6a

  • SHA256

    8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8

  • SHA512

    6f0711fa76e48b9488991b1887e16df90d1ba61a9b95c6ffef5240e6904e14d896a429e0b0ac477d3e53087ebfd77c008dc4cd0ab976ce090cd181d8ec65f777

  • SSDEEP

    98304:/lgpQalSqJ7xojl+11GS0U5pYQ4nGM4OyXlDD:/gRd1ojl6LLYTnGtJl/

Score
9/10
evasiontrojan

Malware Config

Targets

    • Target

      8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8

    • Size

      3.7MB

    • MD5

      6f53e94dbd37e017301aa544a8c182a5

    • SHA1

      b1d3cc7b0e5b6b8b08f98e48231a7779bd1a6c6a

    • SHA256

      8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8

    • SHA512

      6f0711fa76e48b9488991b1887e16df90d1ba61a9b95c6ffef5240e6904e14d896a429e0b0ac477d3e53087ebfd77c008dc4cd0ab976ce090cd181d8ec65f777

    • SSDEEP

      98304:/lgpQalSqJ7xojl+11GS0U5pYQ4nGM4OyXlDD:/gRd1ojl6LLYTnGtJl/

    Score
    9/10
    evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks