6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005 | Triage

Sharing

General

Target

6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005
Size

615KB
Sample

221029-qvx5vahcc9
MD5

3f6b75eb8fb937eb581a803df146c8d1
SHA1

6821beb7883f9b53a7d7950bf3f82183e01d7823
SHA256

6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005
SHA512

4da9cc3c9e25981933687e728940d9036cd9178215a6b2d968656de2fc653dbcca9d70cd603f7055ebec5cb234d4f7702181531968d423bb47747a64beaac248
SSDEEP

12288:dpGjhAf0ecumN16FWjM7kfHq0Ceb1efCpvy9TSV7NYUFwC:dpGCf0xwFEMF071tK27OUB

Score

7^/10

evasion themida

Malware Config

Targets

- Target
  
  6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005
- Size
  
  615KB
- MD5
  
  3f6b75eb8fb937eb581a803df146c8d1
- SHA1
  
  6821beb7883f9b53a7d7950bf3f82183e01d7823
- SHA256
  
  6902d78b19210dd4bd2366de5717468d0762e5430be8a25faaa75333da42c005
- SHA512
  
  4da9cc3c9e25981933687e728940d9036cd9178215a6b2d968656de2fc653dbcca9d70cd603f7055ebec5cb234d4f7702181531968d423bb47747a64beaac248
- SSDEEP
  
  12288:dpGjhAf0ecumN16FWjM7kfHq0Ceb1efCpvy9TSV7NYUFwC:dpGCf0xwFEMF071tK27OUB
Score

7^/10

evasion themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2