Overview

overview

10

Static

static

7

723e7f0611...b7.exe

windows7-x64

10

723e7f0611...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7.zip

  • Size

    1.6MB

  • Sample

    230321-r3f2zabd38

  • MD5

    cf66aaaccfc60ac7d84e1668df9bdc6a

  • SHA1

    a9f61822dfb84c25f6f0c77484d68c16ec2966b9

  • SHA256

    8a03525db5b711c3164bb7d15cf535b362135bba381a9faa0ca53ef354df8a80

  • SHA512

    cd871a4952c629cb06e82277397f637b7167a7c4e47afc983d39142cc792ee6b81cbcfa62b512eace4dbac16c3f57dad30b01418957ff476409e1c84a11bb527

  • SSDEEP

    24576:geHPtu8K28hxRnET3EGubd3nvFb5OIPqVHUfTHXgx7anpU/YmK:gstZx8L1ET3eJ3tbYISxEaapqYB

Score
10/10
privateloaderevasionloaderthemidatrojan

Malware Config

Targets

    • Target

      723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7.exe

    • Size

      3.5MB

    • MD5

      7fe97c1ef6fbf00093805ec6bcbd2676

    • SHA1

      494d23591eccdd8115208b0f78a7a1946d2706f6

    • SHA256

      723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7

    • SHA512

      2e722249ddc85d8e493148395ba344560a5e04f9cfd753a96b773fd940f4974437f153ba803aa173af61682ff3793b9cf5a84b9a12d8f249c6558adc920c5b76

    • SSDEEP

      49152:AM3mNXOGX5f3jpePSFludHU6xUx4+2DDJEq:AKmNX9XB3jpePSF0BNUx4+2D9T

    Score
    10/10
    privateloaderevasionloaderthemidatrojan

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks