Description
evasion.
Activate__Full__Setup.exe
General
Target
Size
Sample
Activate__Full__Setup.exe
2MB
220119-tr9w1sbdh8
Score
10 /10
MD5
SHA1
SHA256
SHA512
1e07343c234d91c56b9dd6618fe2707e
f6d0f9b4543897d9cc5fa6cf98003b74cdf5c237
32d3346ff0178589981d808bfd950b5867e6245bd659d27341269af83785bd6e
a8ecc970e83fada0bff522321376987e28224f57782deabb69c986be6f7caa9c0f9e7c85d6350ac7236f1a7c6b2e1d44230f9a92a59770793c5b2fb3df52de9b
Malware Config
Targets
Target
MD5
Filesize
Activate__Full__Setup.exe
1e07343c234d91c56b9dd6618fe2707e
2MB
Score
10/10
SHA1
SHA256
SHA512
f6d0f9b4543897d9cc5fa6cf98003b74cdf5c237
32d3346ff0178589981d808bfd950b5867e6245bd659d27341269af83785bd6e
a8ecc970e83fada0bff522321376987e28224f57782deabb69c986be6f7caa9c0f9e7c85d6350ac7236f1a7c6b2e1d44230f9a92a59770793c5b2fb3df52de9b
Tags
Signatures
-
evasion
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Tags
TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
Description
BIOS information is often read in order to detect sandboxing environments.
TTPs
-
Drops startup file
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Themida packer
Description
Detects Themida, an advanced Windows software protection system.
Tags
-
Accesses cryptocurrency files/wallets, possible credential harvesting
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabled
Tags
TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks