fb0902eee42d919696c4f445165b1837b8274c9505ebd916fc820e63e9b1202e

Resubmissions

09/09/2024, 00:38

240909-azhmystarn 9

09/09/2024, 00:37

240909-aygn9sware 9

Sharing

Copy URL

Twitter E-mail

General

Target

userassist-toI_1.exe
Size

13.7MB
Sample

240909-azhmystarn
MD5

628fdbd91cb97bb98719319f33906898
SHA1

e02e7c3327e7afef2d3150777247103e397f9c2d
SHA256

fb0902eee42d919696c4f445165b1837b8274c9505ebd916fc820e63e9b1202e
SHA512

13ffa44b52c21bd6b8fbbcf6e5a9db9056af57708dc0c31a47eb6a188305614fb39f756733423af8dd0a576465399ee0aa6cb91335c639f4e350b91dba7512fc
SSDEEP

196608:n00qhHwIhDVxi6b++Hsw+47fw26PtFCu:jq+se6b++Hz+47fwDo

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  userassist-toI_1.exe
- Size
  
  13.7MB
- MD5
  
  628fdbd91cb97bb98719319f33906898
- SHA1
  
  e02e7c3327e7afef2d3150777247103e397f9c2d
- SHA256
  
  fb0902eee42d919696c4f445165b1837b8274c9505ebd916fc820e63e9b1202e
- SHA512
  
  13ffa44b52c21bd6b8fbbcf6e5a9db9056af57708dc0c31a47eb6a188305614fb39f756733423af8dd0a576465399ee0aa6cb91335c639f4e350b91dba7512fc
- SSDEEP
  
  196608:n00qhHwIhDVxi6b++Hsw+47fw26PtFCu:jq+se6b++Hz+47fwDo
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3