Overview

overview

9

Static

static

3

3db21b234d...67.exe

windows7-x64

9

3db21b234d...67.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    3db21b234d52d83dc6900ed307b76f27266d2ebbf05fa1e79d4e4080cb737767.exe.zip

  • Size

    11.1MB

  • Sample

    231031-q94k6sba23

  • MD5

    5137e99998a0a45fc9fb53bbac46097c

  • SHA1

    708ddc706b29a079a2ff9b4511a2703335f251ce

  • SHA256

    707d9f9544a512eec5bafd5d8c0cf82fe30eb3a0238781c4820bafe4caad0399

  • SHA512

    ef4f10c702e2efbdbf12ed72b1cac3266cfee07523ced40c426d50ff8c3307bf49c148b5381f1e687bb0def0ad6857c27697827d0ae873764ac99f3a1609cb90

  • SSDEEP

    196608:f9wjquV7iTG03cveHGyvG71MFCc1Zho/eYFQlbFsFTSjC+fM3fhY4udN/t4QZ3:1NQY38eHxOxwiGYiXsFuLE3JYNr/t7x

Score
9/10
evasionspywarestealerthemidatrojan

Malware Config

Targets

    • Target

      3db21b234d52d83dc6900ed307b76f27266d2ebbf05fa1e79d4e4080cb737767.exe

    • Size

      11.2MB

    • MD5

      7309285efad778af62af78a0a10d4d36

    • SHA1

      c7deb97fa91947de0b006a39dc72aa9c9abc03b8

    • SHA256

      3db21b234d52d83dc6900ed307b76f27266d2ebbf05fa1e79d4e4080cb737767

    • SHA512

      c096beda4aec28caad546afe2fc8c532694ef8238f735877351a2c7f064018948f53674a1fe0e303945ea632953318049284e2f93834084da6dabd67915e6b76

    • SSDEEP

      196608:ZhQCDGbXkCV4jBNz2/45ZZcgJcUG4raKu24YY7HVT4hV0AD6QgqKRgX:XE77qj/F5kGmKr4YYH+EUWpgX

    Score
    9/10
    evasionspywarestealerthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks