1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43 | Triage

Submit
Reports

Overview

overview

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

Sharing

General

Target

1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43
Size

3.7MB
Sample

231127-ffckgsed52
MD5

0e1cb939b809f5da899f037fce19fee2
SHA1

6bc4bee30331e431f953823de645fd607b4ab780
SHA256

1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43
SHA512

73a3fab30eb8877536956475b44a76949a887249adb22b3373d5711c1dfc666b7d6eefa619468d28e509ebe8854fb91631b8cfbaea4d84466ce771459dab08d3
SSDEEP

98304:ZnFdSQtfj0dlCU1MagBHDe+k6ucqeiIP16VcuHFs:ZFdVtfodlZ1Mjei6Pmkzls

Score

10^/10

evasion themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43.exe

Resource

win7-20231025-en

evasion themida trojan

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral2

Sample

1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43.exe

Resource

win10-20231023-en

evasion themida trojan

windows10-1703-x64

7 signatures

300 seconds

Malware Config

Targets

- Target
  
  1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43
- Size
  
  3.7MB
- MD5
  
  0e1cb939b809f5da899f037fce19fee2
- SHA1
  
  6bc4bee30331e431f953823de645fd607b4ab780
- SHA256
  
  1bb44ecab53f956fcec0f1a407d2190deeafa2cfa66c1ea55eaf51115d143a43
- SHA512
  
  73a3fab30eb8877536956475b44a76949a887249adb22b3373d5711c1dfc666b7d6eefa619468d28e509ebe8854fb91631b8cfbaea4d84466ce771459dab08d3
- SSDEEP
  
  98304:ZnFdSQtfj0dlCU1MagBHDe+k6ucqeiIP16VcuHFs:ZFdVtfodlZ1Mjei6Pmkzls
Score

10^/10

evasion themida trojan
- Detects DLL dropped by Raspberry Robin.
  Raspberry Robin.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionthemidatrojan

behavioral2

evasionthemidatrojan

© 2018-2025

Terms | Privacy