Overview

overview

9

Static

static

7

08e7c38215...79.exe

windows7-x64

9

08e7c38215...79.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08e7c3821533df2556ec77843c4225a63a0bb53e08bf6a822b531a64a97cb579

  • Size

    14.4MB

  • Sample

    231007-1kkf4sfe7t

  • MD5

    62497469e2639548550bbcfc31c6fee5

  • SHA1

    b49fe670a48d44d123c917660ef61a05360fd7d3

  • SHA256

    08e7c3821533df2556ec77843c4225a63a0bb53e08bf6a822b531a64a97cb579

  • SHA512

    de03b81c93bebea24c021056643d7e2fbd4c4f5e332934f85ee704da440f869f9a516a39d838a73499093e0bf8c4c82f72766a00fa8e5bfb10ed87f4541c8ff0

  • SSDEEP

    196608:BI749BuLSVih0CGy6XCIrkeNM/AtBZV4RFa5CzmsFmEKos7jiZJ9C1eGmBhuiUj5:BI094Gih0CmCwOsQ7hm3j4CLm5oWVQ1

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      08e7c3821533df2556ec77843c4225a63a0bb53e08bf6a822b531a64a97cb579

    • Size

      14.4MB

    • MD5

      62497469e2639548550bbcfc31c6fee5

    • SHA1

      b49fe670a48d44d123c917660ef61a05360fd7d3

    • SHA256

      08e7c3821533df2556ec77843c4225a63a0bb53e08bf6a822b531a64a97cb579

    • SHA512

      de03b81c93bebea24c021056643d7e2fbd4c4f5e332934f85ee704da440f869f9a516a39d838a73499093e0bf8c4c82f72766a00fa8e5bfb10ed87f4541c8ff0

    • SSDEEP

      196608:BI749BuLSVih0CGy6XCIrkeNM/AtBZV4RFa5CzmsFmEKos7jiZJ9C1eGmBhuiUj5:BI094Gih0CmCwOsQ7hm3j4CLm5oWVQ1

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks