Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    2.7MB

  • Sample

    241122-v3ytka1jen

  • MD5

    9cb310eaaba4f310d47c1b4d401c06b2

  • SHA1

    e1fd02abe8f284002f1287b223cf713c1bf18044

  • SHA256

    e15196f67a2f619908439e73fc2972850234696b0a0eaa84291dc788ebb70cbd

  • SHA512

    583f3f0374c2705eb411b0738e299b5a305508511fddb70868daa953089eb283149d4ff0dfd63ac53b0d513e6623e095881af34945271e1ed3b5b9f293950f52

  • SSDEEP

    49152:ciojptCMzGb4LRkSI/xFZJXSkxBqoL1PyO:ciojpExb6k1XbXNP

Score
10/10
discoveryevasiontrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      2.7MB

    • MD5

      9cb310eaaba4f310d47c1b4d401c06b2

    • SHA1

      e1fd02abe8f284002f1287b223cf713c1bf18044

    • SHA256

      e15196f67a2f619908439e73fc2972850234696b0a0eaa84291dc788ebb70cbd

    • SHA512

      583f3f0374c2705eb411b0738e299b5a305508511fddb70868daa953089eb283149d4ff0dfd63ac53b0d513e6623e095881af34945271e1ed3b5b9f293950f52

    • SSDEEP

      49152:ciojptCMzGb4LRkSI/xFZJXSkxBqoL1PyO:ciojpExb6k1XbXNP

    Score
    10/10
    discoveryevasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Windows security modification

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks