moonrise | a2afef925f5b65854e0c6b9d7426f455678804356453167dfef7eedd4e7cf878

General

Target
a2afef925f5b65854e0c6b9d7426f455678804356453167dfef7eedd4e7cf878
Size 7.3MB
Sample260731-tb2wgach86
SHA256 a2afef925f5b65854e0c6b9d7426f455678804356453167dfef7eedd4e7cf878
MD5 0d29ef184f738fb26a3d4b53c7f46513
SHA1 67cf4ea920a2d0f47e6751bf63d98d31cdf37b8e
SHA512 319d526c7d838bf1cbdcedfda88f1ea27444a9ab6475183a16c2380fbf01df4c7710253265f065ab4b85925a9217b1467908344ca020fb57c037ce6090306129
SSDEEP 49152:eee3taCxEAgX22WFWeirGgJwAllekZSigdwaNJWOAXpxy6n8gELi2jb9SQEdzpyH:eeyh6b/BOA5I65dpt8uLE
TLSH
T1F6764917FCA614E8C1AED1358A7295627F61BC490B2123E32B90F7247F76BD0ADB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

moonrise

C2

https://13.60.13.228:3004

Targets

- Target
  a2afef925f5b65854e0c6b9d7426f455678804356453167dfef7eedd4e7cf878
- Size 7.3MB
- SHA256 a2afef925f5b65854e0c6b9d7426f455678804356453167dfef7eedd4e7cf878
- MD5 0d29ef184f738fb26a3d4b53c7f46513
- SHA1 67cf4ea920a2d0f47e6751bf63d98d31cdf37b8e
- SHA512 319d526c7d838bf1cbdcedfda88f1ea27444a9ab6475183a16c2380fbf01df4c7710253265f065ab4b85925a9217b1467908344ca020fb57c037ce6090306129
- SSDEEP 49152:eee3taCxEAgX22WFWeirGgJwAllekZSigdwaNJWOAXpxy6n8gELi2jb9SQEdzpyH:eeyh6b/BOA5I65dpt8uLE
- TLSH
  T1F6764917FCA614E8C1AED1358A7295627F61BC490B2123E32B90F7247F76BD0ADB9344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

5

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

5

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Looks for VMWare services registry key.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2