Overview

overview

9

Static

static

7

restartserwera.exe

windows7-x64

9

restartserwera.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    restartserwera.exe

  • Size

    7.2MB

  • Sample

    240203-3fhg3aefek

  • MD5

    42b54c18a31575f62928dc111d7ba088

  • SHA1

    3ca800a94077a984b82d342a42fa395802019fd8

  • SHA256

    54b394e487b094033d97e0901a84bf00f6db63e8ea180d077f3fd2ee288b7ece

  • SHA512

    f4212b622ccaac8253ff8b39fe9865abe3e077c4553c3ea7f0ab8c374827c296b664b5d9b9d7299c0ef310f54cd9164c7a0aa09d32f468184cccf38935676652

  • SSDEEP

    196608:c3oNerYFMMHYglsdDsfBT++Dht3kbJmqCh0WsVSjeOI+:c3oNerYFJlQs5ThUmqCWVX1+

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      restartserwera.exe

    • Size

      7.2MB

    • MD5

      42b54c18a31575f62928dc111d7ba088

    • SHA1

      3ca800a94077a984b82d342a42fa395802019fd8

    • SHA256

      54b394e487b094033d97e0901a84bf00f6db63e8ea180d077f3fd2ee288b7ece

    • SHA512

      f4212b622ccaac8253ff8b39fe9865abe3e077c4553c3ea7f0ab8c374827c296b664b5d9b9d7299c0ef310f54cd9164c7a0aa09d32f468184cccf38935676652

    • SSDEEP

      196608:c3oNerYFMMHYglsdDsfBT++Dht3kbJmqCh0WsVSjeOI+:c3oNerYFJlQs5ThUmqCWVX1+

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks