Overview

overview

10

Static

static

7

723e7f0611...b7.exe

windows7-x64

10

723e7f0611...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fe97c1ef6fbf00093805ec6bcbd2676.bin

  • Size

    1.6MB

  • Sample

    230313-m1p5msca8t

  • MD5

    135ab09c5fa4b5951c9edda1929e5fc8

  • SHA1

    a1d8db0c11c70572484545be4b2da0878b418aa2

  • SHA256

    96d33ea836b29933783b18392a5633dc58428e557b3675d490886f9acd7eefc6

  • SHA512

    6a1014c6f01ba1cb1022c9f54f1ea4e293f599acfedc85958290d846c593504fa4fb1a9ca3ca42745095aecc861ad1e8f2c6a00aec5692072471019ea40f9574

  • SSDEEP

    49152:niZrt0TGvRl9x0V8uKGZIX11AvoKc6/9Iu6pOFnUs:n4tBj0V8uTZIPAvoniS6FnP

Score
10/10
privateloaderevasionloaderthemidatrojan

Malware Config

Targets

    • Target

      723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7.exe

    • Size

      3.5MB

    • MD5

      7fe97c1ef6fbf00093805ec6bcbd2676

    • SHA1

      494d23591eccdd8115208b0f78a7a1946d2706f6

    • SHA256

      723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7

    • SHA512

      2e722249ddc85d8e493148395ba344560a5e04f9cfd753a96b773fd940f4974437f153ba803aa173af61682ff3793b9cf5a84b9a12d8f249c6558adc920c5b76

    • SSDEEP

      49152:AM3mNXOGX5f3jpePSFludHU6xUx4+2DDJEq:AKmNX9XB3jpePSF0BNUx4+2D9T

    Score
    10/10
    privateloaderevasionloaderthemidatrojan

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks