4f428aab5f909f6ad07881bf08c1e1ceb160c4a1cb53ac9eabb664f7b46487d8 | Triage

Sharing

General

Target

2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil
Size

21.9MB
Sample

240925-nvk46swhke
MD5

0273a609c7705dd4d44514357d746445
SHA1

a3201cb1f6f72dd334db40e83e1eb22a0db23369
SHA256

4f428aab5f909f6ad07881bf08c1e1ceb160c4a1cb53ac9eabb664f7b46487d8
SHA512

e7aa8557b2c90bd5c5e2c4f0ea14818fa6a2264c9f05eac34b1ad705db3038832a1253a4e88903eda793952ec0db065fad775848bf2a88049a241c232c46ab81
SSDEEP

393216:SK/kMxi5h4DreSca8KlcQnbdBHQVfacMFgXnU7sEl2yD:uh49bbdmVrtXnas

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil
- Size
  
  21.9MB
- MD5
  
  0273a609c7705dd4d44514357d746445
- SHA1
  
  a3201cb1f6f72dd334db40e83e1eb22a0db23369
- SHA256
  
  4f428aab5f909f6ad07881bf08c1e1ceb160c4a1cb53ac9eabb664f7b46487d8
- SHA512
  
  e7aa8557b2c90bd5c5e2c4f0ea14818fa6a2264c9f05eac34b1ad705db3038832a1253a4e88903eda793952ec0db065fad775848bf2a88049a241c232c46ab81
- SSDEEP
  
  393216:SK/kMxi5h4DreSca8KlcQnbdBHQVfacMFgXnU7sEl2yD:uh49bbdmVrtXnas
Score

9^/10

discovery evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion