Overview

overview

10

Static

static

3

f23944ea67...d3.exe

windows7-x64

10

f23944ea67...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e778f61c9564e8c38dab781760f887db.zip

  • Size

    2.5MB

  • Sample

    240831-pg14xasgne

  • MD5

    829b0b8dcdfb4a078853e1353753f570

  • SHA1

    563f8227516c76c2c644a19c8e09201772df8a89

  • SHA256

    68a722859a83b7c222f6f36707657fad914c7b97437f3b73f76cdc4f7b5dc55f

  • SHA512

    75a3f010a8b78801ca4f5daf03e5ba9fd575453d403c260dd1bdb4e9e5f226e7ebec3fbc14c5a8e303701aa975ee6e85ea614900f2d475cf4379f2f4f066befc

  • SSDEEP

    49152:A7mNqkddkTv5B/guFWcRs9l5YYHwQr3VSyXJZSSZZlkEMfPn9N6LVQbAx:A78qkddmwYMr0yXJgSzOEsn9Nfby

Score
10/10
ploutusatmbackdoordiscoveryevasion

Malware Config

Targets

    • Target

      f23944ea67055bcf3fec07b05cd40c63a00f70fd0cec319a7052129aa3ebf4d3

    • Size

      2.7MB

    • MD5

      e778f61c9564e8c38dab781760f887db

    • SHA1

      11954f1cb939390cb94f5652e41a6f69e2d12d37

    • SHA256

      f23944ea67055bcf3fec07b05cd40c63a00f70fd0cec319a7052129aa3ebf4d3

    • SHA512

      af4ec0d66091e0de79ab8e25288e5651e1759098cdfaf6e3f2597c13cf4f12423211e55558a831f4250628b1952beb665fef8dcd7aafde23ad2cc8057bb25800

    • SSDEEP

      49152:UhhsJ2jQ2safBxOtgbekECbgUWtSu7liyyLpLZFcN1sbX6T2CyReacK:e1bJfBxOtg6kEMgQuYyyLpF2N1tVie

    Score
    10/10
    ploutusatmbackdoordiscoveryevasion

    • Detected Ploutus loader

    • Ploutus

      Ploutus is an ATM malware written in C#.

      backdooratmploutus

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks