f2ce87e5b4a14eb64d1d585fbf29ed9eb65ce236fc55c2af35fe3eafbffc45fe

General

Target

f2ce87e5b4a14eb64d1d585fbf29ed9eb65ce236fc55c2af35fe3eafbffc45fe
Size

4.0MB
Sample

231230-lq7fhabcbq
MD5

f0f1ab764f74b3fa36fddd056d865c8e
SHA1

6d8ea11ba8ad1c90a827c46bfe6e4cbbfcbb3842
SHA256

f2ce87e5b4a14eb64d1d585fbf29ed9eb65ce236fc55c2af35fe3eafbffc45fe
SHA512

79c17e7a5bf125df0ee52b94160e95e90fbd43e35eadcb8b701a78ab5f5cd1e2d239d12acb4164bce55142a2b3b59f1fc629246a887ccf852d4b592f675c48b6
SSDEEP

98304:axZR0OpPFrIvsKety1hydMoO6fa0Nj5xF3RayHzQt2TVC:aZBKOy1hmO70NjRhagQt2TVC

Score

9^/10

Malware Config

Targets

- Target
  
  WinController_protected.exe
- Size
  
  3.6MB
- MD5
  
  0a58052011f85a48e3ce05f46f2679e1
- SHA1
  
  b1f1ec342e4a4051db5d56ae438128ecc0097b8b
- SHA256
  
  6b5c257e71b2178cdddd55eafb9ab773f9208c2b1e680277f7b2dd1a13373848
- SHA512
  
  030673e9994e1bbc9ace6b2350fe171c24c3c75b03914cdf32c7e352b36e60063663ecb28edb83a65e33f3140513699b689a1c42e674d6a08d6c9a7e5f952bef
- SSDEEP
  
  98304:XB7tVwcFBzv9oPnPFZtolvCjK1I8UlDF2xBAAfC8rKpIRN:XmcFF6PnfnmfUl8xGj8+p8
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  디펜터끄기/Defender_Settings.vbs
- Size
  
  313B
- MD5
  
  b0bf0a477bcca312021177572311e666
- SHA1
  
  ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA256
  
  af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- SHA512
  
  09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
Score

3^/10
behavioral3 behavioral4
- Target
  
  디펜터끄기/dControl.exe
- Size
  
  447KB
- MD5
  
  58008524a6473bdf86c1040a9a9e39c3
- SHA1
  
  cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA256
  
  1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- SHA512
  
  8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP
  
  6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral5 behavioral6