General

  • Target

    dot-net.exe

  • Size

    8.4MB

  • Sample

    230805-vxr4tsfb7t

  • MD5

    b32a5cca11500732fd104a597feee106

  • SHA1

    512232dcff4be4d3178cf131c486a8d97b603b47

  • SHA256

    31d228182a9ffecf579827600edc90b95efc52d3bc15c8e5fba8fb02b23b73c9

  • SHA512

    c563f75ab476f74e56a1e3c748e23ceabb1d5d3561685636b9f99d5bb097b2179e092e4524d869e5aeafb0d9842a6c97e8731cdc0cfeceefb4417a8dd48eb1a4

  • SSDEEP

    196608:mpkDYTucUG4raKu24YY7HVT4hV0AD6QgqKRgX:LmKr4YYH+EUWpgX

Score
7/10

Malware Config

Targets

    • Target

      dot-net.exe

    • Size

      8.4MB

    • MD5

      b32a5cca11500732fd104a597feee106

    • SHA1

      512232dcff4be4d3178cf131c486a8d97b603b47

    • SHA256

      31d228182a9ffecf579827600edc90b95efc52d3bc15c8e5fba8fb02b23b73c9

    • SHA512

      c563f75ab476f74e56a1e3c748e23ceabb1d5d3561685636b9f99d5bb097b2179e092e4524d869e5aeafb0d9842a6c97e8731cdc0cfeceefb4417a8dd48eb1a4

    • SSDEEP

      196608:mpkDYTucUG4raKu24YY7HVT4hV0AD6QgqKRgX:LmKr4YYH+EUWpgX

    Score
    7/10
    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix

Tasks