Overview

overview

9

Static

static

7

Notepad++.exe

windows7-x64

9

Notepad++.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NecrumV5.rar

  • Size

    12.8MB

  • Sample

    230711-zhl2gsag33

  • MD5

    b29fc6156d97a4df79bd03f711b4cef5

  • SHA1

    45fa2273d532aa00a700b520793ca10fac16d873

  • SHA256

    e36bcb48a7e2cd6d8973d8548820d2c4bb07930faf4d2cc49afcb7c2dae36b8b

  • SHA512

    5179ee09788d08f8a27a0f799d81d828f655363d08fae49728014d2ed4411ea54888736cc6130d0d591d8575ebca926d82d7393f4eecddbc49cc0b2b5cee2baa

  • SSDEEP

    196608:j1a0YgQJf2sQ4JPZDvQdmIFIq6QJ4B/vcNF/5RNt32OXeyHqeCIVzF7pOPxroUhi:ha0YgQdJB8dmIFIqDi3cJmOXX5J7M5Eb

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Notepad++.exe

    • Size

      13.2MB

    • MD5

      4c5a2f1dcb060935502d979011bb4577

    • SHA1

      d9c1464fa8f9d67bb552349945547dac00fbf5b1

    • SHA256

      5f3bf5f20c250f6f70dc0fe5753a1ee88935b4224ef93c0749ffdc2d3480929b

    • SHA512

      f917f88188d6b730f816551a7754412b49f33d2f0c4bcfb5a6c960279abce923935b34603b9c66028e925d25240f13e219495eac36f4cbc425d53fa6d30c988f

    • SSDEEP

      196608:9U+z/tCPFdoGylKJmHhLXzX1iqMDZ7txfjE+OU58h14L/5CGZChzXa207N7:xtwfmHRXzXHM5vhBeg/3ZC82

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks