Overview

overview

9

Static

static

7

0b30f80f1a...a9.exe

windows7_x64

9

0b30f80f1a...a9.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b30f80f1a4302af74f78328ea9fd9ad265f9c8b3ff72cb0c6a78fb3374ca1a9

  • Size

    2.7MB

  • Sample

    220215-s6w32ahham

  • MD5

    a5b12ab8a3fc98d4ed6d6f9becedca61

  • SHA1

    1e291df778dfc18fd8e1036f2e224263f8997024

  • SHA256

    0b30f80f1a4302af74f78328ea9fd9ad265f9c8b3ff72cb0c6a78fb3374ca1a9

  • SHA512

    526ac2778cacd14d54ad2831a1893e94580d09fd2678aaa4a47d9a93948c73d33e0618168604b7c27056a1487a49ffe931248f1592591573feec4f1ee8cdebf9

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      0b30f80f1a4302af74f78328ea9fd9ad265f9c8b3ff72cb0c6a78fb3374ca1a9

    • Size

      2.7MB

    • MD5

      a5b12ab8a3fc98d4ed6d6f9becedca61

    • SHA1

      1e291df778dfc18fd8e1036f2e224263f8997024

    • SHA256

      0b30f80f1a4302af74f78328ea9fd9ad265f9c8b3ff72cb0c6a78fb3374ca1a9

    • SHA512

      526ac2778cacd14d54ad2831a1893e94580d09fd2678aaa4a47d9a93948c73d33e0618168604b7c27056a1487a49ffe931248f1592591573feec4f1ee8cdebf9

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks