Overview

overview

9

Static

static

7

loader.exe

windows10-2004-x64

9

Resubmissions

11-03-2023 18:18

230311-wxqrfaag64 9

11-03-2023 18:17

230311-wxa1zscf4t 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    3.6MB

  • Sample

    230311-wxqrfaag64

  • MD5

    5e221f2c35233b1cdf4f2048d2954e38

  • SHA1

    e721b83ddf11804b71d3ebd66fd22885c433b3ab

  • SHA256

    41164927e8cc6e0efa8f14f5818630627c9dd816f2ef27eca479ce7728367c7c

  • SHA512

    8cea3635d1940296a76b1aff70f347ebbb9d7ac35b3214145698c3eb65525643f677df833e2688dfacbed655030d8a3d34721613d91dae8d6294edbe62108c4d

  • SSDEEP

    98304:BpANYNo/82gxti8an9ILRB8zFzmH3Cr9f9GUpnoc3:Bq4ok2gxtizn9I9BCCH3CrTpnf

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      loader.exe

    • Size

      3.6MB

    • MD5

      5e221f2c35233b1cdf4f2048d2954e38

    • SHA1

      e721b83ddf11804b71d3ebd66fd22885c433b3ab

    • SHA256

      41164927e8cc6e0efa8f14f5818630627c9dd816f2ef27eca479ce7728367c7c

    • SHA512

      8cea3635d1940296a76b1aff70f347ebbb9d7ac35b3214145698c3eb65525643f677df833e2688dfacbed655030d8a3d34721613d91dae8d6294edbe62108c4d

    • SSDEEP

      98304:BpANYNo/82gxti8an9ILRB8zFzmH3Cr9f9GUpnoc3:Bq4ok2gxtizn9I9BCCH3CrTpnf

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks