Overview

overview

9

Static

static

7

exLoader.exe

windows7_x64

9

exLoader.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d709ae1b37c9d383982989ae7e3f6c8c2612eb1a9a661707a419e5440891fcc6

  • Size

    3.0MB

  • Sample

    211229-rac5lsdebn

  • MD5

    a980cc8ca74998b88f37ae1223dc3e10

  • SHA1

    ec8774ccfe7a228e4edcf4b6bb5666e66cceabc5

  • SHA256

    d709ae1b37c9d383982989ae7e3f6c8c2612eb1a9a661707a419e5440891fcc6

  • SHA512

    ddb263ed514e5595d52b16e82dae940c88ba086681e2abb44ba7cba0f6390a6da0d7ac34096c7da5e0407435faf6a302f2e62356e166962f84d803c960ff5de3

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      exLoader.exe

    • Size

      3.0MB

    • MD5

      1c0a1da7b182eb810f8f682129def781

    • SHA1

      a781d30ed510e218609d4f45fec4a24b7e31f625

    • SHA256

      7347dab747d69502c28a5ab0c462b75dc2b6dfe9b78042f2464004375c5902e5

    • SHA512

      35be08dda96f0e52243c0ecde4a51aa5656e97c578f825a66eaa04e345f00c90d24d9ccf3da902c8138841aef8f6afffcc6dd75dfe1c13a099f5976d3154cf2d

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks