0ecc20f2e5f96252997b16bf7b516a77b595bd480a050db2a6ca3b55eb56b53b

Resubmissions

30/11/2022, 17:41

221130-v9ts7abe2510

30/11/2022, 17:10

221130-vp2nascf3s9

Sharing

Copy URL Twitter E-mail

General

Target
0ecc20f2e5f96252997b16bf7b516a77b595bd480a050db2a6ca3b55eb56b53b
Size 2.5MB
Sample221130-vp2nascf3s
SHA256 0ecc20f2e5f96252997b16bf7b516a77b595bd480a050db2a6ca3b55eb56b53b
MD5 a001612855d4a8ef91a81fcc04c78923
SHA1 852a3107921557748edd48175f5c14e9bd90d84a
SHA512 2dfdda74dff7a57d55ee36e9cc056f06410cc07bbd5f7bcf35efa525f1cc06108a9f3ad8015abe8e81cf8564b2b49ddc51568a1613673bf1f5e4f9d9f1091173
SSDEEP 49152:GoTnBCUzCLIB8whjke0k3+DNufQFbwBUreGDs1wa3zUprbFLKxvT1t+IE:GPowXD/2GreGDsPoRLKx3hE
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  0ecc20f2e5f96252997b16bf7b516a77b595bd480a050db2a6ca3b55eb56b53b
- Size 2.5MB
- SHA256 0ecc20f2e5f96252997b16bf7b516a77b595bd480a050db2a6ca3b55eb56b53b
- MD5 a001612855d4a8ef91a81fcc04c78923
- SHA1 852a3107921557748edd48175f5c14e9bd90d84a
- SHA512 2dfdda74dff7a57d55ee36e9cc056f06410cc07bbd5f7bcf35efa525f1cc06108a9f3ad8015abe8e81cf8564b2b49ddc51568a1613673bf1f5e4f9d9f1091173
- SSDEEP 49152:GoTnBCUzCLIB8whjke0k3+DNufQFbwBUreGDs1wa3zUprbFLKxvT1t+IE:GPowXD/2GreGDsPoRLKx3hE
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2