Overview

overview

9

Static

static

7

65.zip

windows10-2004-x64

9

Resubmissions

25-09-2022 03:46

220925-eb17lsdah4 9

25-09-2022 03:25

220925-dy3hhsedal 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65.zip

  • Size

    9.8MB

  • Sample

    220925-dy3hhsedal

  • MD5

    b144b58537058fc572d9bcbf668a9ed2

  • SHA1

    02f6955335085d91177fcf329930465bb301c4bc

  • SHA256

    f1b2df0cdb1576dfe30733fbf2936c5dcc530ea15f60377c0402ca3eec28e039

  • SHA512

    ea5c48378fabd584618e05413a35b2a45b0ad07a31beed5b09b0cdadc83aac52e9191f77441f524d29058e2257d595dfaa608b918be439a6f2edb7026c3032a0

  • SSDEEP

    196608:0KbwvkBYSQHIhE6wczxbaG1Ysr6LPr14B5shyl+Gyajsuh3bTiZI1MJD6g:0KNYSNzxbaGXMx4B5sh5GHsu5+qCJD1

Score
9/10
evasionthemida

Malware Config

Targets

    • Target

      65.zip

    • Size

      9.8MB

    • MD5

      b144b58537058fc572d9bcbf668a9ed2

    • SHA1

      02f6955335085d91177fcf329930465bb301c4bc

    • SHA256

      f1b2df0cdb1576dfe30733fbf2936c5dcc530ea15f60377c0402ca3eec28e039

    • SHA512

      ea5c48378fabd584618e05413a35b2a45b0ad07a31beed5b09b0cdadc83aac52e9191f77441f524d29058e2257d595dfaa608b918be439a6f2edb7026c3032a0

    • SSDEEP

      196608:0KbwvkBYSQHIhE6wczxbaG1Ysr6LPr14B5shyl+Gyajsuh3bTiZI1MJD6g:0KNYSNzxbaGXMx4B5sh5GHsu5+qCJD1

    Score
    9/10
    evasionthemida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks