8a602beefc5b5b78a185c4aea8bc09c5705de8a89086824c4f482be556b02850 | Triage

Sharing

General

Target

8a602beefc5b5b78a185c4aea8bc09c5705de8a89086824c4f482be556b02850
Size

737KB
Sample

221129-gl99dabf36
MD5

ddfa8744fc553696e4199eb6e3227033
SHA1

cbd1aa7e353f03e07d60a1c468a2f3ff2a1716a1
SHA256

8a602beefc5b5b78a185c4aea8bc09c5705de8a89086824c4f482be556b02850
SHA512

2d3686ca7bc5db5f391cefcf30e27cd0b156d18c92073818a239fa6df2e989e92ef1096d919aa4a45fc6f3922ad2ac5909de38d4818394cf77730d4fec3c8c3f
SSDEEP

12288:b9Kj4EXIELst7fChKCp791x86cKXg0e6QC6ZhKdkBW0sTUR0Hpt8sKPCEvB3:TEXhL6ukm9kmbe6Z6h6YkXMPCEvB

Score

7^/10

evasion themida

Malware Config

Targets

- Target
  
  8a602beefc5b5b78a185c4aea8bc09c5705de8a89086824c4f482be556b02850
- Size
  
  737KB
- MD5
  
  ddfa8744fc553696e4199eb6e3227033
- SHA1
  
  cbd1aa7e353f03e07d60a1c468a2f3ff2a1716a1
- SHA256
  
  8a602beefc5b5b78a185c4aea8bc09c5705de8a89086824c4f482be556b02850
- SHA512
  
  2d3686ca7bc5db5f391cefcf30e27cd0b156d18c92073818a239fa6df2e989e92ef1096d919aa4a45fc6f3922ad2ac5909de38d4818394cf77730d4fec3c8c3f
- SSDEEP
  
  12288:b9Kj4EXIELst7fChKCp791x86cKXg0e6QC6ZhKdkBW0sTUR0Hpt8sKPCEvB3:TEXhL6ukm9kmbe6Z6h6YkXMPCEvB
Score

7^/10

evasion themida
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2