3fb009714328e46c4507efd4c1b5efc49f7bdc7e597db9f49cb5081943c1cd9f | Triage

Sharing

General

Target

3fb009714328e46c4507efd4c1b5efc49f7bdc7e597db9f49cb5081943c1cd9f
Size

6.5MB
Sample

240903-zsaq7sxhlh
MD5

9966d187d83ac328ba50f5136a86b636
SHA1

e94407e4fea23e93ca804a60712218109e2a9654
SHA256

3fb009714328e46c4507efd4c1b5efc49f7bdc7e597db9f49cb5081943c1cd9f
SHA512

4b00a9d213a87891b2ef41aea9e25de65e7874c0543d437c2c53d6b82778961e512cb14fa7120f1ba6eb5765e821026d9f0927257acbc38d5dcb0195d099eb92
SSDEEP

98304:O29z8VLSyeSOOIhbGdddddddlwxPjBbWDBqxl5rGsyluIGsLKg+DZmSW/9q:4LVeSOOIhS+jMBCQQWg

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  3fb009714328e46c4507efd4c1b5efc49f7bdc7e597db9f49cb5081943c1cd9f
- Size
  
  6.5MB
- MD5
  
  9966d187d83ac328ba50f5136a86b636
- SHA1
  
  e94407e4fea23e93ca804a60712218109e2a9654
- SHA256
  
  3fb009714328e46c4507efd4c1b5efc49f7bdc7e597db9f49cb5081943c1cd9f
- SHA512
  
  4b00a9d213a87891b2ef41aea9e25de65e7874c0543d437c2c53d6b82778961e512cb14fa7120f1ba6eb5765e821026d9f0927257acbc38d5dcb0195d099eb92
- SSDEEP
  
  98304:O29z8VLSyeSOOIhbGdddddddlwxPjBbWDBqxl5rGsyluIGsLKg+DZmSW/9q:4LVeSOOIhS+jMBCQQWg
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion