Overview

overview

9

Static

static

7

d5a0c28c1b...24.exe

windows7-x64

9

d5a0c28c1b...24.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5a0c28c1b0198033e57c75f95c921244071ce7e2eebec74e66f384627900824.zip

  • Size

    3.3MB

  • Sample

    230321-rz252abc44

  • MD5

    810ab9577cc5e0efe87ef0688eba700b

  • SHA1

    1432b96db1f4024f4a218b06a12186a9ea87bacb

  • SHA256

    40c9698c41f7575d5c05a059f73067072dffb2001454cc8571de6ec4d7a6aad9

  • SHA512

    277f3e5f3fdad041289ce1e4798c87f4ebcee2052c68d37b59aaa6eb9361d2287c56fd37ee8abc1b0e75991d0204ba732b545c4af73a9d53bb03ee125a80e301

  • SSDEEP

    98304:lj8tBKxoRjMOpGDRpuoEOjKeX7xGkUAKqJbr:lj8tkotMvrEOXQkU4t

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      d5a0c28c1b0198033e57c75f95c921244071ce7e2eebec74e66f384627900824.exe

    • Size

      3.4MB

    • MD5

      780e2eb727a2a278795471059f4d6b33

    • SHA1

      2911c5de51eaf1ae82e96fc26c1505cbfa7f0641

    • SHA256

      d5a0c28c1b0198033e57c75f95c921244071ce7e2eebec74e66f384627900824

    • SHA512

      bf1748e47377290b9356d6ac5f42cfdc974117cc21e901d5443f71348930af37d6eaf3d8363464297454560396ea1d87cc5804b415d1fb8db01a5859ff3026ed

    • SSDEEP

      98304:OWYHz9DAMmWXxVkYIs0xQIk5Zq7IvQEJ/lnvf0xSOS:KHz9MP1s0LkTqUvbhNvfdp

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks