General
- Target easy lol free retrac.rar
- Size 462KB
- Sample260824-ge2cwscb87
- SHA256 2cbcbaafbf9412afc209fd9324852b23dcc9bdc8bfef02b784460112745c2065
Score
9/10
Malware Config
Targets
-
- Target easy lol free retrac.rar
- Size 462KB
- SHA256 2cbcbaafbf9412afc209fd9324852b23dcc9bdc8bfef02b784460112745c2065
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Looks for VMWare Tools registry key
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1