Overview

overview

7

Static

static

7

b911f3ccc3...71.dll

windows7_x64

7

b911f3ccc3...71.dll

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b911f3ccc39031fc77b5b5dc15e8c4c10642edb961e5dd1799bbae80888d5471

  • Size

    648KB

  • Sample

    220714-fytxgsfcen

  • MD5

    47cf2312142053973478a73c2221eea6

  • SHA1

    6b50b6c1bb38de64ab2835387043e70e7add744f

  • SHA256

    b911f3ccc39031fc77b5b5dc15e8c4c10642edb961e5dd1799bbae80888d5471

  • SHA512

    5a41a77798991958097616fa5959f4ea39ca370a7513179f96c9a03524252690084a4a50b290148327aa9b8b8af88d24d2ea218dbfac47ac5b1b7cd7584efcb3

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      b911f3ccc39031fc77b5b5dc15e8c4c10642edb961e5dd1799bbae80888d5471

    • Size

      648KB

    • MD5

      47cf2312142053973478a73c2221eea6

    • SHA1

      6b50b6c1bb38de64ab2835387043e70e7add744f

    • SHA256

      b911f3ccc39031fc77b5b5dc15e8c4c10642edb961e5dd1799bbae80888d5471

    • SHA512

      5a41a77798991958097616fa5959f4ea39ca370a7513179f96c9a03524252690084a4a50b290148327aa9b8b8af88d24d2ea218dbfac47ac5b1b7cd7584efcb3

    Score
    7/10
    evasionthemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks