General

  • Target

    2FEaKkukrgVw.exe

  • Size

    13.9MB

  • Sample

    250104-xknxraslcs

  • MD5

    a4dc525d4e27ec12e444410dfb8e3b73

  • SHA1

    38e655176a8401087c9f905f2ea6f465175357af

  • SHA256

    910d12b881b9874b889038f887f8d6e35028ce414341c604e4f71ee8fa13566b

  • SHA512

    32c74f62ab1339e30b6dcb8cb386a09224d77dd59f2b24d1c4c162f1987ce8f0f42107cc6b82a4a1aa974576a82f5faa0e8950b4bdf6b5c958c187d397221024

  • SSDEEP

    393216:IJzWUq3UKKeizYH2jBkzv7qZ/CMKGvZ/0ZtCHr:I5W1nezCTzDAC1GxvHr

Malware Config

Targets

    • Target

      2FEaKkukrgVw.exe

    • Size

      13.9MB

    • MD5

      a4dc525d4e27ec12e444410dfb8e3b73

    • SHA1

      38e655176a8401087c9f905f2ea6f465175357af

    • SHA256

      910d12b881b9874b889038f887f8d6e35028ce414341c604e4f71ee8fa13566b

    • SHA512

      32c74f62ab1339e30b6dcb8cb386a09224d77dd59f2b24d1c4c162f1987ce8f0f42107cc6b82a4a1aa974576a82f5faa0e8950b4bdf6b5c958c187d397221024

    • SSDEEP

      393216:IJzWUq3UKKeizYH2jBkzv7qZ/CMKGvZ/0ZtCHr:I5W1nezCTzDAC1GxvHr

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks