dbb23e697ddf674ff2d0bc732192cfada3d8293e65b70805b6c21b37dec03a25 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dbb23e697ddf674ff2d0bc732192cfada3d8293e65b70805b6c21b37dec03a25N
Size

5.5MB
Sample

240930-g6de5svdre
MD5

c4865b3d54ee16b441b5411077b15560
SHA1

a9be8a48ac0e0e84d775acb51ffd0a6460788c10
SHA256

dbb23e697ddf674ff2d0bc732192cfada3d8293e65b70805b6c21b37dec03a25
SHA512

9b97b41c8df576310abd502687a36a1a4614c016ec30c033bbaece5b78082eab15fa2b11b52f3003794dfa9ebecc266ace8bfed72ee4c54e286eb38055086f25
SSDEEP

98304:ohFcAQNBRvP0ZqfYORzo2Iceutfczjbq1aBHIf43TdUPPUeDdxPJkiZBPJp:ohfQNBRvP8JcefzjW1YHlTdSMeDdpJkQ

Score

9^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  dbb23e697ddf674ff2d0bc732192cfada3d8293e65b70805b6c21b37dec03a25N
- Size
  
  5.5MB
- MD5
  
  c4865b3d54ee16b441b5411077b15560
- SHA1
  
  a9be8a48ac0e0e84d775acb51ffd0a6460788c10
- SHA256
  
  dbb23e697ddf674ff2d0bc732192cfada3d8293e65b70805b6c21b37dec03a25
- SHA512
  
  9b97b41c8df576310abd502687a36a1a4614c016ec30c033bbaece5b78082eab15fa2b11b52f3003794dfa9ebecc266ace8bfed72ee4c54e286eb38055086f25
- SSDEEP
  
  98304:ohFcAQNBRvP0ZqfYORzo2Iceutfczjbq1aBHIf43TdUPPUeDdxPJkiZBPJp:ohfQNBRvP8JcefzjW1YHlTdSMeDdpJkQ
Score

9^/10

discovery evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2