General

  • Target

    94d38f4c1c1c750622cc9a92742fe8463ec04fd95d860df27bd04d3902b5def4

  • Size

    2.4MB

  • Sample

    241113-txf6wsvfrf

  • MD5

    6cfdc961d328b239abaffb25bd4dd327

  • SHA1

    a41d639e82da73d197f51d123fd7adedf82823c4

  • SHA256

    94d38f4c1c1c750622cc9a92742fe8463ec04fd95d860df27bd04d3902b5def4

  • SHA512

    a7eb13418df822d05f3c6272a615c222441f781f6b7154407603d32058c9efa370c2fb0a0b318c75cdc6ee89782fc7309d8fbc37211841ea14d7c3c210e6755a

  • SSDEEP

    49152:b7vfvtrNtJg0EOZjzXL3Z36nmmHIvbWcVdrnuQqLihIkoPH67DI:vf1rUO5zX1qnmmoDbr/obBHuDI

Malware Config

Targets

    • Target

      94d38f4c1c1c750622cc9a92742fe8463ec04fd95d860df27bd04d3902b5def4

    • Size

      2.4MB

    • MD5

      6cfdc961d328b239abaffb25bd4dd327

    • SHA1

      a41d639e82da73d197f51d123fd7adedf82823c4

    • SHA256

      94d38f4c1c1c750622cc9a92742fe8463ec04fd95d860df27bd04d3902b5def4

    • SHA512

      a7eb13418df822d05f3c6272a615c222441f781f6b7154407603d32058c9efa370c2fb0a0b318c75cdc6ee89782fc7309d8fbc37211841ea14d7c3c210e6755a

    • SSDEEP

      49152:b7vfvtrNtJg0EOZjzXL3Z36nmmHIvbWcVdrnuQqLihIkoPH67DI:vf1rUO5zX1qnmmoDbr/obBHuDI

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks