Overview

overview

9

Static

static

7

celex (2).exe

windows10-2004-x64

9

Resubmissions

14/01/2024, 02:54

240114-deay6aaggm 9

14/01/2024, 02:53

240114-ddp2paagfr 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    celex (2).exe

  • Size

    3.9MB

  • Sample

    240114-ddp2paagfr

  • MD5

    aae3b29c8d99af040f081889083f660b

  • SHA1

    0c9790afc12772a0749e0175afb729d51f10db62

  • SHA256

    3e91bc08acf84fdf063121dec7336c28a84f0a4e4bda43f581cf1771293708bd

  • SHA512

    b9b152bca89320cfe053893ff3a8c0bbb9b42d6eebdb948f5b3026c94d8ea45590e2b9a54d8c3e38bbfa81f1a36e7e392481c0dac257c2c8780da6ae2bec4073

  • SSDEEP

    98304:/fuW0ChRCkV8YKWQ7ZM045jl2vA/X8+YouTFu:t3CkFKTM0AAvl+Y9u

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      celex (2).exe

    • Size

      3.9MB

    • MD5

      aae3b29c8d99af040f081889083f660b

    • SHA1

      0c9790afc12772a0749e0175afb729d51f10db62

    • SHA256

      3e91bc08acf84fdf063121dec7336c28a84f0a4e4bda43f581cf1771293708bd

    • SHA512

      b9b152bca89320cfe053893ff3a8c0bbb9b42d6eebdb948f5b3026c94d8ea45590e2b9a54d8c3e38bbfa81f1a36e7e392481c0dac257c2c8780da6ae2bec4073

    • SSDEEP

      98304:/fuW0ChRCkV8YKWQ7ZM045jl2vA/X8+YouTFu:t3CkFKTM0AAvl+Y9u

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks