aa7e600161d7614b3e08d40494f2d4bc
General
Target
Size
Sample
aa7e600161d7614b3e08d40494f2d4bc
3MB
220120-j41h1aghfp
Score
9 /10
MD5
SHA1
SHA256
SHA512
aa7e600161d7614b3e08d40494f2d4bc
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f
Malware Config
Targets
Target
MD5
Filesize
aa7e600161d7614b3e08d40494f2d4bc
aa7e600161d7614b3e08d40494f2d4bc
3MB
Score
9/10
SHA1
SHA256
SHA512
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f
Tags
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
Description
BIOS information is often read in order to detect sandboxing environments.
TTPs
-
Drops startup file
-
Loads dropped DLL
-
Themida packer
Description
Detects Themida, an advanced Windows software protection system.
Tags
-
Checks whether UAC is enabled
Tags
TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks