Overview

overview

9

Static

static

3

sAzhN5bnXpgK.exe

windows7-x64

9

sAzhN5bnXpgK.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sAzhN5bnXpgK.exe

  • Size

    14.5MB

  • Sample

    241101-wmc3lavncj

  • MD5

    e18af4ec2a94adc7fce737ea0ccb5fd7

  • SHA1

    d7e0db1075509710324d6f342a1192f3349f51dd

  • SHA256

    a17dc408ed5a1176c16dd8961c0d2a37e5f2cf52e1460e2b1d1f781ffe8696ef

  • SHA512

    4b1676962738d9fae50650eb06f62e3eb5e96ec45c8467cff2d7f6db06ed04d9b2825f07cc5a5a1814558fd1e7006ecc08fe68e560b973110d05884fa491f765

  • SSDEEP

    393216:/YZ/li9krqIBGhOC996/B7QarSpn3XI7cGmy533eW7:s/likrqU8p96Z7gXI7cny5+g

Score
9/10
discoveryevasiontrojan

Malware Config

Targets

    • Target

      sAzhN5bnXpgK.exe

    • Size

      14.5MB

    • MD5

      e18af4ec2a94adc7fce737ea0ccb5fd7

    • SHA1

      d7e0db1075509710324d6f342a1192f3349f51dd

    • SHA256

      a17dc408ed5a1176c16dd8961c0d2a37e5f2cf52e1460e2b1d1f781ffe8696ef

    • SHA512

      4b1676962738d9fae50650eb06f62e3eb5e96ec45c8467cff2d7f6db06ed04d9b2825f07cc5a5a1814558fd1e7006ecc08fe68e560b973110d05884fa491f765

    • SSDEEP

      393216:/YZ/li9krqIBGhOC996/B7QarSpn3XI7cGmy533eW7:s/likrqU8p96Z7gXI7cny5+g

    Score
    9/10
    discoveryevasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks