3ac34007735480d39372d9f6134c2068c716fe5514d608a351ca9a6d7bc56fe2 | Triage

Sharing

General

Target

3ac34007735480d39372d9f6134c2068c716fe5514d608a351ca9a6d7bc56fe2
Size

2.6MB
Sample

241121-x3scwszlar
MD5

8d6be2ae7d7980c17bfcc04baff0197b
SHA1

c6276d5eb88d2e3c262d56a8b2d34c120eb7f635
SHA256

3ac34007735480d39372d9f6134c2068c716fe5514d608a351ca9a6d7bc56fe2
SHA512

7c911345ac61f3cb11f790982a7c7856577a5eaf8c42ac904084dee167a6f4464adb62436780777efae41aa98cd3ed09c77b579862d3e0f5f139aa84fcce118f
SSDEEP

49152:9NCDDt6uqGQ2XxCzynx+Px/hK/Lm9y1VGM0y/z:XCDDtDqGzXxxxE/Ia9kVEM

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  3ac34007735480d39372d9f6134c2068c716fe5514d608a351ca9a6d7bc56fe2
- Size
  
  2.6MB
- MD5
  
  8d6be2ae7d7980c17bfcc04baff0197b
- SHA1
  
  c6276d5eb88d2e3c262d56a8b2d34c120eb7f635
- SHA256
  
  3ac34007735480d39372d9f6134c2068c716fe5514d608a351ca9a6d7bc56fe2
- SHA512
  
  7c911345ac61f3cb11f790982a7c7856577a5eaf8c42ac904084dee167a6f4464adb62436780777efae41aa98cd3ed09c77b579862d3e0f5f139aa84fcce118f
- SSDEEP
  
  49152:9NCDDt6uqGQ2XxCzynx+Px/hK/Lm9y1VGM0y/z:XCDDtDqGzXxxxE/Ia9kVEM
Score

10^/10

discovery evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan