87e2c9a4d8eb62d78e1873125842edbb3d329e2f3aa3d7e0eb0e2a609957b87b | Triage

Sharing

General

Target

4fc28f8386b849a5633c3b4f97decd24.bin
Size

1.6MB
Sample

241122-bl3awa1mew
MD5

a94c120aab1c61af60cec6edfa650d37
SHA1

93b8adf236250c9d63e0c6fdb3b6927bef5abedb
SHA256

87e2c9a4d8eb62d78e1873125842edbb3d329e2f3aa3d7e0eb0e2a609957b87b
SHA512

9d32a29ac3c36fb6832dc780393c979de4513a388eed756f4f4e926fe3839ba493c5fda87c136db04fd519a81c575e3afd68d8013db611e2ae828098e7f79004
SSDEEP

24576:gV+cYP4JzcmHQat6szoOKTJBOhj+YnEUrOSl9h0nmsunn3ZF/935teeV1MAAeuxE:gu4aayXTq+Yn3rcmbpPaeTTuPMH

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  5e33b2113f70189d082a8c87ae822718976c90a84e3a29d55c7acf8f940797f5.exe
- Size
  
  2.7MB
- MD5
  
  4fc28f8386b849a5633c3b4f97decd24
- SHA1
  
  2f68e0e548d77a1fc5b871ca56246ecf7810799c
- SHA256
  
  5e33b2113f70189d082a8c87ae822718976c90a84e3a29d55c7acf8f940797f5
- SHA512
  
  6c66eddc75a4acab38093fccb11f22572c0875ca8e1c182ae67e6628460e2302784165b2173d4593e9a1b9c6546cc0035e8798d218b90f338b94d54ed51d70ad
- SSDEEP
  
  49152:lXkjvna4eQ2tQdEbLRrD4aAFjnTyTyrdCddM+5Jf:lXkjvnjeQ2tKEbdhAFjwdr
Score

10^/10

discovery evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan