aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4 | Triage

Submit
Reports

Overview

overview

9

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

General

Target

aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
Size

5.7MB
Sample

231122-fj6bzabb5w
MD5

a6d0999d10c4d3a1aee18d73693a5b13
SHA1

298d75d1850f7596991aa739fd73738982792442
SHA256

aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
SHA512

f5e1e976f7e7a561081297c293d11c06ae471d90d0df167fc57c581cb4cb6b2b5d31f7a8c413de058e9f924b55a9a44c338c6c054ee0947f87dfd59d6b6c3348
SSDEEP

98304:9BALWhkuHRdKG2B746zHzhEgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJoBeTPRZ:9mahkuHRl2jzGgNvpbXZ778hsIvY6j1R

Score

9^/10

evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4.exe

Resource

win7-20231023-en

evasion themida trojan

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral2

Sample

aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4.exe

Resource

win10-20231023-en

evasion themida trojan

windows10-1703-x64

11 signatures

300 seconds

Malware Config

Targets

- Target
  
  aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
- Size
  
  5.7MB
- MD5
  
  a6d0999d10c4d3a1aee18d73693a5b13
- SHA1
  
  298d75d1850f7596991aa739fd73738982792442
- SHA256
  
  aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
- SHA512
  
  f5e1e976f7e7a561081297c293d11c06ae471d90d0df167fc57c581cb4cb6b2b5d31f7a8c413de058e9f924b55a9a44c338c6c054ee0947f87dfd59d6b6c3348
- SSDEEP
  
  98304:9BALWhkuHRdKG2B746zHzhEgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJoBeTPRZ:9mahkuHRl2jzGgNvpbXZ778hsIvY6j1R
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionthemidatrojan

behavioral2

evasionthemidatrojan

© 2018-2025

Terms | Privacy