Overview

overview

9

Static

static

8

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24cac780158e82f1f07fd0f752d84b9e039296fbf08765230c98f89ea0cad142

  • Size

    5.5MB

  • Sample

    221031-166apseecq

  • MD5

    81f14b336cea939b52ef0b8ebb6b8e80

  • SHA1

    28755e6a8068fa7f9afd9f36c432e3d72d0378c3

  • SHA256

    24cac780158e82f1f07fd0f752d84b9e039296fbf08765230c98f89ea0cad142

  • SHA512

    0c435a3754cdcc495171842937c786ff20bbb7ba2f4bb665415a93ce1d0c596896756a289c1e62f8b4d9ce3e1d2bddb1e29c154487f5cae31e9300b72940ae2c

  • SSDEEP

    98304:7sONGbKoZLqOPg/d6fpRSDVpX9cXbS/hRrk8wAgBa+nRm1FIar7j:4bKgLBKdQQWLS5RY8wAgBa+RQFIar7j

Score
9/10
evasionthemidatrojanupx

Malware Config

Targets

    • Target

      24cac780158e82f1f07fd0f752d84b9e039296fbf08765230c98f89ea0cad142

    • Size

      5.5MB

    • MD5

      81f14b336cea939b52ef0b8ebb6b8e80

    • SHA1

      28755e6a8068fa7f9afd9f36c432e3d72d0378c3

    • SHA256

      24cac780158e82f1f07fd0f752d84b9e039296fbf08765230c98f89ea0cad142

    • SHA512

      0c435a3754cdcc495171842937c786ff20bbb7ba2f4bb665415a93ce1d0c596896756a289c1e62f8b4d9ce3e1d2bddb1e29c154487f5cae31e9300b72940ae2c

    • SSDEEP

      98304:7sONGbKoZLqOPg/d6fpRSDVpX9cXbS/hRrk8wAgBa+nRm1FIar7j:4bKgLBKdQQWLS5RY8wAgBa+RQFIar7j

    Score
    9/10
    evasionthemidatrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks