General
- Target 5074bff84ab5b6b3b575542a0df7df9a69bd98aa8959d99618f0d27ab6a26c8f
- Size 5.6MB
- Sample260928-rxnjvsbc46
- SHA256 5074bff84ab5b6b3b575542a0df7df9a69bd98aa8959d99618f0d27ab6a26c8f
Score
9/10
Malware Config
Targets
-
- Target 5074bff84ab5b6b3b575542a0df7df9a69bd98aa8959d99618f0d27ab6a26c8f
- Size 5.6MB
- SHA256 5074bff84ab5b6b3b575542a0df7df9a69bd98aa8959d99618f0d27ab6a26c8f
Score9/10-
Looks for VirtualBox drivers on disk
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Looks for VMWare drivers on disk
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1