8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9 | Triage

Submit
Reports

Overview

overview

9

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

General

Target

8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9
Size

1.6MB
Sample

220722-175essabf2
MD5

c037ec35abf70d0367f4a41ae16e7226
SHA1

8d3c519235913e0ac5e507fb0b816f9a275d489b
SHA256

8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9
SHA512

0986a3b7de0c975a0a867dce71869811466b28378986e4d1fb8a9dd5e178e0082a5f744a580e7012d35c23374c33ff1fd3f659b11f502d1505eb4b7a7ebfe158

Score

9^/10

evasion persistence themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9.exe

Resource

win7-20220718-en

evasion persistence themida trojan

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral2

Sample

8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9.exe

Resource

win10-20220718-en

evasion persistence themida trojan

windows10-1703-x64

7 signatures

300 seconds

Malware Config

Targets

- Target
  
  8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9
- Size
  
  1.6MB
- MD5
  
  c037ec35abf70d0367f4a41ae16e7226
- SHA1
  
  8d3c519235913e0ac5e507fb0b816f9a275d489b
- SHA256
  
  8b58757c429503a45480ae6baa5509b21e55d5c1fe81574871acc9d2edae22c9
- SHA512
  
  0986a3b7de0c975a0a867dce71869811466b28378986e4d1fb8a9dd5e178e0082a5f744a580e7012d35c23374c33ff1fd3f659b11f502d1505eb4b7a7ebfe158
Score

9^/10

evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencethemidatrojan

behavioral2

evasionpersistencethemidatrojan

© 2018-2024

Terms | Privacy