Overview

overview

9

Static

static

7

f9f750d16d...e0.exe

windows7_x64

9

f9f750d16d...e0.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9f750d16dc2eda2a8315fd425fe4bd01694a71b6cdf1ee3bd0ea564d14138e0

  • Size

    2.7MB

  • Sample

    220215-e61jkaccek

  • MD5

    87f7ba3eb4b8db330ad80286d7fde49a

  • SHA1

    960e37d97ea6cb6826455889ab3bb3ff6be644a7

  • SHA256

    f9f750d16dc2eda2a8315fd425fe4bd01694a71b6cdf1ee3bd0ea564d14138e0

  • SHA512

    1f9dc98573a55ef490da60528a72b7d1325aaf9629fd203017a9be64739a7679de06666ea932d2678ebe1804a1df55620e3810d1bcfc265d9e2fbf0e6205fe19

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      f9f750d16dc2eda2a8315fd425fe4bd01694a71b6cdf1ee3bd0ea564d14138e0

    • Size

      2.7MB

    • MD5

      87f7ba3eb4b8db330ad80286d7fde49a

    • SHA1

      960e37d97ea6cb6826455889ab3bb3ff6be644a7

    • SHA256

      f9f750d16dc2eda2a8315fd425fe4bd01694a71b6cdf1ee3bd0ea564d14138e0

    • SHA512

      1f9dc98573a55ef490da60528a72b7d1325aaf9629fd203017a9be64739a7679de06666ea932d2678ebe1804a1df55620e3810d1bcfc265d9e2fbf0e6205fe19

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks