Extracted

• • Target

    ConsoleApplication1_protected.exe

  • Size

    24.9MB

  • MD5

    c92b3adc71593399adca81dc7b695f07

  • SHA1

    4265756d847c8f47649c615105be4e51454c4a25

  • SHA256

    8c36c4018ed237ae9c5b285c4f7b079bf53621e130a2eeacb9c4cb6d377f8026

  • SHA512

    02bafa5fb89486bbe013afe7f45178e58b399ba5b6efce2e472f9f92cc33f40caffd4c4c09f5649a97343bdc1c7b823fbbc71e2e4220c5debab0e45aab5e2cbd

  • SSDEEP

    786432:JuuEgy4SMkw587wn9+xzCaH6iglrEV1MThSKvHQ/Y713:eJ4SM12kK6/l1tSMiYJ3

  Score

  10^/10

  umbralevasionstealerthemidatrojan

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1