Overview

overview

9

Static

static

7

9c85d76526...44.exe

windows7-x64

9

9c85d76526...44.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3459f3a3d65fa445d1eb52611ac55f6c.bin

  • Size

    6.5MB

  • Sample

    230325-bmt1wsce3w

  • MD5

    37bb213fa7553ef3bf57666283b0eb2f

  • SHA1

    850d13afb3c7ad12ddbf4ec615d7b0658d0391d2

  • SHA256

    3f13b7b6809971fe0004de8053da65c1f76b2eed90b25ee00d8a7eb0087ef871

  • SHA512

    7e9d345162bf3ef8407a4efda8f3e7ae0fd81362ac2075b2f0925937dba62084f4dfd5d06ddb960d777a9a4d570809576664b9c0978230c59e364ce16871acec

  • SSDEEP

    196608:pghD4JO2Eo8U1KIjzqRTXZQMgRBhVxvyYYlsjDSXJ:gR2sU1KSzqpgR/VFYl6w

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944.bin

    • Size

      6.6MB

    • MD5

      3459f3a3d65fa445d1eb52611ac55f6c

    • SHA1

      135c835edfeec60e41bc1b24f1a10ad7a86c9a00

    • SHA256

      9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944

    • SHA512

      1dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b

    • SSDEEP

      98304:MsRRwjPcDZ3IFTbWJ6tWUQSPZyq2XOD6gwosVvC8pQ6TYupGFBUMnEB:MsRKjkNcyDVSROtgwJVvHjTrUIMni

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks