Overview

overview

10

Static

static

10

RIP_YOUR_PC_LOL.exe

windows10-2004_x64

10

Resubmissions

06-10-2023 19:40

231006-ydmxjsfe5s 10

07-08-2023 11:23

230807-ng6tqafa49 10

07-08-2023 11:15

230807-ncqlyagb9z 10

06-08-2023 21:35

230806-1fltdadf7y 10

24-07-2023 06:23

230724-g5yppabb61 10

24-07-2023 06:22

230724-g41snaaf98 10

05-07-2023 08:43

230705-kmlh7abc54 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RIP_YOUR_PC_LOL.exe

  • Size

    22.5MB

  • Sample

    220115-gpv9madccl

  • MD5

    52867174362410d63215d78e708103ea

  • SHA1

    7ae4e1048e4463a4201bdeaf224c5b6face681bf

  • SHA256

    37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a

  • SHA512

    89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab

Score
10/10
asyncratnanocorenjratevasionratsuricatathemidatrojan

Malware Config

Targets

    • Target

      RIP_YOUR_PC_LOL.exe

    • Size

      22.5MB

    • MD5

      52867174362410d63215d78e708103ea

    • SHA1

      7ae4e1048e4463a4201bdeaf224c5b6face681bf

    • SHA256

      37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a

    • SHA512

      89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab

    Score
    10/10
    evasionsuricatathemidatrojan

    • suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3

      suricata: ET MALWARE Fake Software Download Redirect Leading to Malware M3

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks