Overview

overview

9

Static

static

7

70e67ea4fb...12.exe

windows7-x64

9

70e67ea4fb...12.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70e67ea4fb9a978c36ef74b1b444033164bd27ec1154877bce3728dfb2c16612

  • Size

    5.9MB

  • Sample

    220802-p3hvfsgbdn

  • MD5

    de7d69fd0ebf821ca7a588d72fbeb3cc

  • SHA1

    0a1adde1614a0f72b2f8a94eb1cd721ed0761be5

  • SHA256

    70e67ea4fb9a978c36ef74b1b444033164bd27ec1154877bce3728dfb2c16612

  • SHA512

    1f98bae0e89016178b2bcd81532757a848e182336839991683761bf82068fee06929314c33efbd42beb16cdef31c72899c3a7e844fec72be3edd241b5f4fc3e9

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      70e67ea4fb9a978c36ef74b1b444033164bd27ec1154877bce3728dfb2c16612

    • Size

      5.9MB

    • MD5

      de7d69fd0ebf821ca7a588d72fbeb3cc

    • SHA1

      0a1adde1614a0f72b2f8a94eb1cd721ed0761be5

    • SHA256

      70e67ea4fb9a978c36ef74b1b444033164bd27ec1154877bce3728dfb2c16612

    • SHA512

      1f98bae0e89016178b2bcd81532757a848e182336839991683761bf82068fee06929314c33efbd42beb16cdef31c72899c3a7e844fec72be3edd241b5f4fc3e9

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks