Overview

overview

9

Static

static

3

LDR.exe

windows7-x64

9

LDR.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    LDR.exe

  • Size

    10.4MB

  • Sample

    240128-qegg6abda6

  • MD5

    e42925429a22a958683eeeba04ff1e19

  • SHA1

    731eaba39ec46165a15f79fa739af57382f3a842

  • SHA256

    799dbf0b2c7792f3945379c9e7fb4d6e8996e1e5cecdf2b68eef395f8034e651

  • SHA512

    f820545a2b0009ed79c4bf7999ccc1091b7d88e20e0c74c562a467a96f17d20423b4a9f751754f095114784f794e2322bf572e11b082b4d6f444ffd6e6548fd7

  • SSDEEP

    196608:VFeI8pAbyqEyT1WGMF8trjvy41c1QajSJsMEkJPmpm1ljvKX/WWmFtC/0JrtcdR:VFJZbytyxtyccygSyK+m1ljyvTmLWe5e

Score
9/10
evasiontrojan

Malware Config

Targets

    • Target

      LDR.exe

    • Size

      10.4MB

    • MD5

      e42925429a22a958683eeeba04ff1e19

    • SHA1

      731eaba39ec46165a15f79fa739af57382f3a842

    • SHA256

      799dbf0b2c7792f3945379c9e7fb4d6e8996e1e5cecdf2b68eef395f8034e651

    • SHA512

      f820545a2b0009ed79c4bf7999ccc1091b7d88e20e0c74c562a467a96f17d20423b4a9f751754f095114784f794e2322bf572e11b082b4d6f444ffd6e6548fd7

    • SSDEEP

      196608:VFeI8pAbyqEyT1WGMF8trjvy41c1QajSJsMEkJPmpm1ljvKX/WWmFtC/0JrtcdR:VFJZbytyxtyccygSyK+m1ljyvTmLWe5e

    Score
    9/10
    evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks