Overview

overview

9

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a

  • Size

    1.9MB

  • Sample

    220724-16bfbsacd2

  • MD5

    f1652e3ed08e855c196507b001b22c76

  • SHA1

    83c5b113042a8f077ec7f84baa0a94511a72072d

  • SHA256

    edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a

  • SHA512

    923ffa8310be31762fe942ddb092b58203b2da1673050f71c2b6058ad63850b7fbbf187bea8d461fe103c599a6c29360c90b9a7619d09fab03679c7efd6bd903

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a

    • Size

      1.9MB

    • MD5

      f1652e3ed08e855c196507b001b22c76

    • SHA1

      83c5b113042a8f077ec7f84baa0a94511a72072d

    • SHA256

      edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a

    • SHA512

      923ffa8310be31762fe942ddb092b58203b2da1673050f71c2b6058ad63850b7fbbf187bea8d461fe103c599a6c29360c90b9a7619d09fab03679c7efd6bd903

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks