Overview

overview

7

Static

static

7

da5652d725...71.exe

windows7-x64

7

da5652d725...71.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da5652d7256e72fabbcd7a0e326b2ba619a3cd6437b6ebf2fcc1563d433f9571

  • Size

    1.7MB

  • Sample

    220730-yl534adha9

  • MD5

    61da9ff9dcab5f6ea30aa3d043864797

  • SHA1

    0ffbb226f30b52c834c9b6e489de197bda2f1069

  • SHA256

    da5652d7256e72fabbcd7a0e326b2ba619a3cd6437b6ebf2fcc1563d433f9571

  • SHA512

    7af05f8c9c85356f76eac6a7ff02c062906242b0f1cd519b44fb5016754abfb24e6917b2e1e99d77e45a2e9e7a2e025ce3b24b26b6ec5abb39ef30b48852e006

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      da5652d7256e72fabbcd7a0e326b2ba619a3cd6437b6ebf2fcc1563d433f9571

    • Size

      1.7MB

    • MD5

      61da9ff9dcab5f6ea30aa3d043864797

    • SHA1

      0ffbb226f30b52c834c9b6e489de197bda2f1069

    • SHA256

      da5652d7256e72fabbcd7a0e326b2ba619a3cd6437b6ebf2fcc1563d433f9571

    • SHA512

      7af05f8c9c85356f76eac6a7ff02c062906242b0f1cd519b44fb5016754abfb24e6917b2e1e99d77e45a2e9e7a2e025ce3b24b26b6ec5abb39ef30b48852e006

    Score
    7/10
    evasionthemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks