8605c1bb0fdde4e2a33ee97a115720e277facd8c02516d62e918e75bb9403368 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8605c1bb0fdde4e2a33ee97a115720e277facd8c02516d62e918e75bb9403368
Size

2.1MB
Sample

221202-vgn28sba9t
MD5

6fb6ea0f4e67518329ce8463f8f924b0
SHA1

4787f75afeae3b42ede83945ae4093ed819ba7df
SHA256

8605c1bb0fdde4e2a33ee97a115720e277facd8c02516d62e918e75bb9403368
SHA512

5583dce45377b6b66e82b695c1a71fbd4de817a4ec19643342c57192c2d0e6ddc9b40ed56f727d6a17a6f96b1985c407e1a8cdea916bf49a49319e3d90c742d1
SSDEEP

24576:b6/RHp7XRgsAr0htc25azmnmO4bf79sGv2LzCIJJ35xpYex6iHpy7FwzqJrMYGLQ:8sIhqMaxO4dj+SIJPHpyhBMYMYLjhuh

Score

7^/10

evasion themida

Malware Config

Targets

- Target
  
  8605c1bb0fdde4e2a33ee97a115720e277facd8c02516d62e918e75bb9403368
- Size
  
  2.1MB
- MD5
  
  6fb6ea0f4e67518329ce8463f8f924b0
- SHA1
  
  4787f75afeae3b42ede83945ae4093ed819ba7df
- SHA256
  
  8605c1bb0fdde4e2a33ee97a115720e277facd8c02516d62e918e75bb9403368
- SHA512
  
  5583dce45377b6b66e82b695c1a71fbd4de817a4ec19643342c57192c2d0e6ddc9b40ed56f727d6a17a6f96b1985c407e1a8cdea916bf49a49319e3d90c742d1
- SSDEEP
  
  24576:b6/RHp7XRgsAr0htc25azmnmO4bf79sGv2LzCIJJ35xpYex6iHpy7FwzqJrMYGLQ:8sIhqMaxO4dj+SIJPHpyhBMYMYLjhuh
Score

7^/10

evasion themida
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2