Overview

overview

9

Static

static

7

PCHunter64_new.exe

windows7-x64

9

PCHunter64_new.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PCHunter64_new.exe

  • Size

    6.8MB

  • Sample

    221129-lsdwzage43

  • MD5

    a2ed2bf5957b0b2d33eb778a443d15d0

  • SHA1

    889b45e70070c3ef4b8cd900fdc43140a5ed8105

  • SHA256

    866f59529cf4e0a4c2c4bcd2b9d5d18ece73bf99470ea1be81b26f91b586b174

  • SHA512

    b50b7416bc75324866407e08fd9bb29b0abed501e0720bb77721ce4922d7512221f93becc9cd37efd73b4bf0984d4db5a4da13e896f988256333d972e22ffba8

  • SSDEEP

    98304:9/oLQtqGhZrqNPMethNf9LemgaIhyZKylL+bKtOK6d6ZyrcWfQubWXk:9z7rqeer3VIhGNcKtOK6d6QrJIlk

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      PCHunter64_new.exe

    • Size

      6.8MB

    • MD5

      a2ed2bf5957b0b2d33eb778a443d15d0

    • SHA1

      889b45e70070c3ef4b8cd900fdc43140a5ed8105

    • SHA256

      866f59529cf4e0a4c2c4bcd2b9d5d18ece73bf99470ea1be81b26f91b586b174

    • SHA512

      b50b7416bc75324866407e08fd9bb29b0abed501e0720bb77721ce4922d7512221f93becc9cd37efd73b4bf0984d4db5a4da13e896f988256333d972e22ffba8

    • SSDEEP

      98304:9/oLQtqGhZrqNPMethNf9LemgaIhyZKylL+bKtOK6d6ZyrcWfQubWXk:9z7rqeer3VIhGNcKtOK6d6QrJIlk

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks