Overview

overview

9

Static

static

8 Ball Eas...er.exe

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8 Ball Easy Ruller.exe

  • Size

    26.1MB

  • Sample

    221127-1m1wwabc48

  • MD5

    519df891f3154660065aec417d8c4050

  • SHA1

    2478389f400150ce197a96a9f13b349eb8476221

  • SHA256

    8932956dc17dc1cb138b58c2a2f0c24111cf925ebd75affacdf9359cae0ba292

  • SHA512

    43db07addccb9c50943c45ef6b0fc53e0e4afd02888d81b5c5e7a5d4a04b5ef90775864f11442bab027365a1426022d8a6e66e10c3f10700c9b6ff46af00d229

  • SSDEEP

    393216:/ugawpqeWJdQep7AcU4m8DyztSwTOV68ChdjBhe7igrW2cmfechcnph1tQhAS/pv:0wAeWDcMDatSwCV6NdjipWCzh82hAwpv

Score
9/10
discoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      8 Ball Easy Ruller.exe

    • Size

      26.1MB

    • MD5

      519df891f3154660065aec417d8c4050

    • SHA1

      2478389f400150ce197a96a9f13b349eb8476221

    • SHA256

      8932956dc17dc1cb138b58c2a2f0c24111cf925ebd75affacdf9359cae0ba292

    • SHA512

      43db07addccb9c50943c45ef6b0fc53e0e4afd02888d81b5c5e7a5d4a04b5ef90775864f11442bab027365a1426022d8a6e66e10c3f10700c9b6ff46af00d229

    • SSDEEP

      393216:/ugawpqeWJdQep7AcU4m8DyztSwTOV68ChdjBhe7igrW2cmfechcnph1tQhAS/pv:0wAeWDcMDatSwCV6NdjipWCzh82hAwpv

    Score
    9/10
    discoveryevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks