Overview

overview

10

Static

static

7

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.8MB

  • Sample

    230615-n6a4cagd4x

  • MD5

    cb6c8836d11f81972af7f9a0658b4a0b

  • SHA1

    9b36bdfe197325a9200ed3a567fd7a8822367fef

  • SHA256

    85fe02b41de8287d183798770adfd1ebc75d08d2fcfe9f582ade03862e494a6a

  • SHA512

    eff2ef3addfafe6032870869313a1b001950733ef44397de1bfe0b40089d82e9a113f6190a14ce96e6e8e226ef5e780af732b97248a4ef3d666608ff265ce83c

  • SSDEEP

    49152:yo0PXNM2wyUYStkNEWVWvhPpfCcGJ9Cm:yo016zYNovhPpacGJ

Score
10/10
lgoogloaderdownloaderevasionthemidatrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.8MB

    • MD5

      cb6c8836d11f81972af7f9a0658b4a0b

    • SHA1

      9b36bdfe197325a9200ed3a567fd7a8822367fef

    • SHA256

      85fe02b41de8287d183798770adfd1ebc75d08d2fcfe9f582ade03862e494a6a

    • SHA512

      eff2ef3addfafe6032870869313a1b001950733ef44397de1bfe0b40089d82e9a113f6190a14ce96e6e8e226ef5e780af732b97248a4ef3d666608ff265ce83c

    • SSDEEP

      49152:yo0PXNM2wyUYStkNEWVWvhPpfCcGJ9Cm:yo016zYNovhPpacGJ

    Score
    10/10
    lgoogloaderdownloaderevasionthemidatrojan

    • Detects LgoogLoader payload

    • LgoogLoader

      A downloader capable of dropping and executing other malware families.

      downloaderlgoogloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks