177bd385c98d209a6bb678043c87f65c2f8c4e203d777ea61fc38dfa7f6e1a93 | Triage

Sharing

General

Target

FL64.exe
Size

13.7MB
Sample

240927-jj264asbkk
MD5

45707da9e74c99056b4f7742df1324e8
SHA1

c9da0dc1cf5b4b8b441fa1ec009973cce9dcce4d
SHA256

177bd385c98d209a6bb678043c87f65c2f8c4e203d777ea61fc38dfa7f6e1a93
SHA512

c45e2d37f99f265b8c00b291593c0e53a92634f452be2c750052c576fb1a4337aaa019c1fe2a110db54914ece4228de4bcd3489fbcf927ff5292241523b939bd
SSDEEP

393216:qIG8bNZPSXUqlFWBHmh1mnclubQGOr+JUSWspb:OYNlUUnmh1AxbdV

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  FL64.exe
- Size
  
  13.7MB
- MD5
  
  45707da9e74c99056b4f7742df1324e8
- SHA1
  
  c9da0dc1cf5b4b8b441fa1ec009973cce9dcce4d
- SHA256
  
  177bd385c98d209a6bb678043c87f65c2f8c4e203d777ea61fc38dfa7f6e1a93
- SHA512
  
  c45e2d37f99f265b8c00b291593c0e53a92634f452be2c750052c576fb1a4337aaa019c1fe2a110db54914ece4228de4bcd3489fbcf927ff5292241523b939bd
- SSDEEP
  
  393216:qIG8bNZPSXUqlFWBHmh1mnclubQGOr+JUSWspb:OYNlUUnmh1AxbdV
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1