Overview

overview

10

Static

static

7

build_bFQKU5z9Qm.exe

windows7-x64

10

build_bFQKU5z9Qm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    build_bFQKU5z9Qm.exe

  • Size

    8.2MB

  • Sample

    221209-x81lfsea53

  • MD5

    987df25308de13c798c9f125ea8e58f3

  • SHA1

    f4004e48ea96c4159653113dd884c549a006248f

  • SHA256

    16dfb998d47b5809c086c246eac6839e692f30211debc107994a0877385ad147

  • SHA512

    825b3501475d21d0443925b2001d91a6cc8c41b585a2c4d1d846d8fb050af82eb1b8f7a5e1cb4334cf6b1d25744ed4a0e509faa6bee31acd27e92d94f2dc430d

  • SSDEEP

    196608:Xs8AtIGFmr/pOhL18xzIzaVT8x+1vNc9Eh9J1Ap4I:8pIGUYhLtmc2vNc9El1g4

Score
10/10
elysiumstealerevasionstealerthemidatrojan

Malware Config

Targets

    • Target

      build_bFQKU5z9Qm.exe

    • Size

      8.2MB

    • MD5

      987df25308de13c798c9f125ea8e58f3

    • SHA1

      f4004e48ea96c4159653113dd884c549a006248f

    • SHA256

      16dfb998d47b5809c086c246eac6839e692f30211debc107994a0877385ad147

    • SHA512

      825b3501475d21d0443925b2001d91a6cc8c41b585a2c4d1d846d8fb050af82eb1b8f7a5e1cb4334cf6b1d25744ed4a0e509faa6bee31acd27e92d94f2dc430d

    • SSDEEP

      196608:Xs8AtIGFmr/pOhL18xzIzaVT8x+1vNc9Eh9J1Ap4I:8pIGUYhLtmc2vNc9El1g4

    Score
    10/10
    elysiumstealerevasionstealerthemidatrojan

    • ElysiumStealer

      ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

      stealerelysiumstealer

    • ElysiumStealer Support DLL

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks