Overview

overview

7

Static

static

chthonic_1...ir.exe

windows7_x64

7

chthonic_1...ir.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    chthonic_1.0.0.0.vir

  • Size

    108KB

  • Sample

    200719-1sm7s1ez52

  • MD5

    4fedceb3fef8b8addd7b34b3cae72700

  • SHA1

    0d688c4a150368ba01513aa816ff524d223aaa79

  • SHA256

    95f698955cf8a1adf8991085da2c45f4441e0423b7db42aae3dc0dd6c4dfaa28

  • SHA512

    b8fd269d0876de12bbb5c9ad0d407d3f08c2778c320fdb2443a2a8efcaa17044fbf46a7f419de5d526ac86cce04db6f86e8223c832c0cdc1c26abd4249f90ff0

Score
7/10
evasiontrojan

Malware Config

Targets

    • Target

      chthonic_1.0.0.0.vir

    • Size

      108KB

    • MD5

      4fedceb3fef8b8addd7b34b3cae72700

    • SHA1

      0d688c4a150368ba01513aa816ff524d223aaa79

    • SHA256

      95f698955cf8a1adf8991085da2c45f4441e0423b7db42aae3dc0dd6c4dfaa28

    • SHA512

      b8fd269d0876de12bbb5c9ad0d407d3f08c2778c320fdb2443a2a8efcaa17044fbf46a7f419de5d526ac86cce04db6f86e8223c832c0cdc1c26abd4249f90ff0

    Score
    7/10
    evasiontrojan

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks