Overview

overview

9

Static

static

7

8366aa3fe0...2b.dll

windows7-x64

9

8366aa3fe0...2b.dll

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    8366aa3fe0aa70cd001b16a7d939e4b772c200d6ec0d7987e862025fc0f07d2b

  • Size

    4.9MB

  • Sample

    231010-1j8gjsdb3w

  • MD5

    2cc50e6ac22447a643d9100c960c5925

  • SHA1

    175654c88c398829d509fc35a64975d1b6c2a45a

  • SHA256

    8366aa3fe0aa70cd001b16a7d939e4b772c200d6ec0d7987e862025fc0f07d2b

  • SHA512

    7671a72a842abb553278395da2ae3e60b1e1504d165207ba5f2ee819d0b2f2dcd60cb92dc906a1e157a65afd5f9db2f97c6f4c9bd5841e18802ed267e382b9fb

  • SSDEEP

    98304:fgiRoN9h0ssR0EalBhFOKUEu3WCgTRGCNVQ:fRRo3h0ssRnaLh1C3WCghv

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      8366aa3fe0aa70cd001b16a7d939e4b772c200d6ec0d7987e862025fc0f07d2b

    • Size

      4.9MB

    • MD5

      2cc50e6ac22447a643d9100c960c5925

    • SHA1

      175654c88c398829d509fc35a64975d1b6c2a45a

    • SHA256

      8366aa3fe0aa70cd001b16a7d939e4b772c200d6ec0d7987e862025fc0f07d2b

    • SHA512

      7671a72a842abb553278395da2ae3e60b1e1504d165207ba5f2ee819d0b2f2dcd60cb92dc906a1e157a65afd5f9db2f97c6f4c9bd5841e18802ed267e382b9fb

    • SSDEEP

      98304:fgiRoN9h0ssR0EalBhFOKUEu3WCgTRGCNVQ:fRRo3h0ssRnaLh1C3WCghv

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks