Overview

overview

10

Static

static

7

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    4.3MB

  • Sample

    230314-fppamsff3w

  • MD5

    dc420d217ceaa342947187224505a034

  • SHA1

    9dc25130ede5f985135bc3129b31802441c9729e

  • SHA256

    592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735

  • SHA512

    d9151dab6e26f09841ce86e1d060ccc4e9dc019d3567195fc0a99ed86c497596179e138e0db3a656dfc18ee024fd4660e8036f44383604111d350af6c883f2ae

  • SSDEEP

    98304:/Hrl0QKys7P7CbM5zD6sILTjblMS0uJXAW0uQ9WCJ+SR8hR:/Ljhsi4osI3jhMSNJXA29CJF8hR

Score
10/10
privateloaderevasionloaderthemidatrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      4.3MB

    • MD5

      dc420d217ceaa342947187224505a034

    • SHA1

      9dc25130ede5f985135bc3129b31802441c9729e

    • SHA256

      592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735

    • SHA512

      d9151dab6e26f09841ce86e1d060ccc4e9dc019d3567195fc0a99ed86c497596179e138e0db3a656dfc18ee024fd4660e8036f44383604111d350af6c883f2ae

    • SSDEEP

      98304:/Hrl0QKys7P7CbM5zD6sILTjblMS0uJXAW0uQ9WCJ+SR8hR:/Ljhsi4osI3jhMSNJXA29CJF8hR

    Score
    10/10
    privateloaderevasionloaderthemidatrojan

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks