Overview

overview

9

Static

static

7

Loader_protected.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader_protected.exe

  • Size

    20.1MB

  • Sample

    230626-1k3mpaca62

  • MD5

    e1da0a80a2d605e6ba207cf23d859746

  • SHA1

    ea0f3faa15a6aaefe29578d0c2760427c3d17157

  • SHA256

    c671335413caf251b6fe41c5e2f4c9d4eed0d94c8eb0028dec6ec25b4eaadb77

  • SHA512

    527813d6fd51bc9a6cc00e629cd501ba688c23b621f19bb84fc6af99a2268e9d9d3d2cdaf2f56f47b21716e011aafad242653a9a35072bebf4230d65a5bab6c0

  • SSDEEP

    393216:z0uwoEhQafz8ZbTlckQlfqVvIkbdKt3S1bWyOqO2qedCMfhzHR:A3rhQS8hl2fqVvI4EtWiJKnfh

Score
9/10
evasionthemidatrojanupx

Malware Config

Targets

    • Target

      Loader_protected.exe

    • Size

      20.1MB

    • MD5

      e1da0a80a2d605e6ba207cf23d859746

    • SHA1

      ea0f3faa15a6aaefe29578d0c2760427c3d17157

    • SHA256

      c671335413caf251b6fe41c5e2f4c9d4eed0d94c8eb0028dec6ec25b4eaadb77

    • SHA512

      527813d6fd51bc9a6cc00e629cd501ba688c23b621f19bb84fc6af99a2268e9d9d3d2cdaf2f56f47b21716e011aafad242653a9a35072bebf4230d65a5bab6c0

    • SSDEEP

      393216:z0uwoEhQafz8ZbTlckQlfqVvIkbdKt3S1bWyOqO2qedCMfhzHR:A3rhQS8hl2fqVvI4EtWiJKnfh

    Score
    9/10
    evasionthemidatrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks