Overview

overview

9

Static

static

7

456729a9e5...65.exe

windows7_x64

9

456729a9e5...65.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65

  • Size

    8.0MB

  • Sample

    220212-h97c3abagq

  • MD5

    d6bb5bbd20581612e3672d5e3f8e1cc1

  • SHA1

    97f2cda4f530bcc1fddfe3f27e3f782d01069a7e

  • SHA256

    456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65

  • SHA512

    dc875db4548bfc2d743eb524a8cb1bfde0d43434a54ced69c38918943d485ea6a11a4baca85018b65da44bfb9660f0238d40bb6a41ba6152f996d0eb808919cf

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65

    • Size

      8.0MB

    • MD5

      d6bb5bbd20581612e3672d5e3f8e1cc1

    • SHA1

      97f2cda4f530bcc1fddfe3f27e3f782d01069a7e

    • SHA256

      456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65

    • SHA512

      dc875db4548bfc2d743eb524a8cb1bfde0d43434a54ced69c38918943d485ea6a11a4baca85018b65da44bfb9660f0238d40bb6a41ba6152f996d0eb808919cf

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks