Overview

overview

9

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    0facf2fa327805c21cab85b4c89d7edf6e1abf335dd06ae025560be016245abf

  • Size

    5.4MB

  • Sample

    231121-feq2gscc85

  • MD5

    92c1b5c7679716b5edac05b5b0d2e722

  • SHA1

    81b6c61f463b7c47e5e6cc56d91a1ef24f9fc1ac

  • SHA256

    0facf2fa327805c21cab85b4c89d7edf6e1abf335dd06ae025560be016245abf

  • SHA512

    d892b64fbe06828fae3ab52ca70f0056bf115e76f7cc1d54d4b5c67cdb045e42926ed71fde4b07dc0d34f3055819981a0a1d1fd99f29709bfa9bf4eb1c88bfd6

  • SSDEEP

    98304:sLa8Jjq1OO0s/oMf+4oq/xV2gNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJFRoP1d:KM1O1s/ooOq/xV2gNvpbXZ778hsIvY6A

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      0facf2fa327805c21cab85b4c89d7edf6e1abf335dd06ae025560be016245abf

    • Size

      5.4MB

    • MD5

      92c1b5c7679716b5edac05b5b0d2e722

    • SHA1

      81b6c61f463b7c47e5e6cc56d91a1ef24f9fc1ac

    • SHA256

      0facf2fa327805c21cab85b4c89d7edf6e1abf335dd06ae025560be016245abf

    • SHA512

      d892b64fbe06828fae3ab52ca70f0056bf115e76f7cc1d54d4b5c67cdb045e42926ed71fde4b07dc0d34f3055819981a0a1d1fd99f29709bfa9bf4eb1c88bfd6

    • SSDEEP

      98304:sLa8Jjq1OO0s/oMf+4oq/xV2gNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJFRoP1d:KM1O1s/ooOq/xV2gNvpbXZ778hsIvY6A

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks