Overview

overview

9

Static

static

7

Horizon V1.3.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Horizon V1.3.exe

  • Size

    4.5MB

  • Sample

    240219-t4njjsgg97

  • MD5

    28d17aed09e71258fcbb212eda97cd0c

  • SHA1

    ed2a325a250b338f2a645de1221ad47a7cff7386

  • SHA256

    a18aae6764feaa6eb50eb3a80b432c39818406a4346ca4d17ddcf2d36578562e

  • SHA512

    580b7f050dc9b1d52a0707153256e0c93a2c622ba0fe22ac6137601763ef9e031fbc643197a552bbe41cff3ecbfab0606e9c2f925d473cd9859c14c349f0685f

  • SSDEEP

    98304:T/p1o+JaUzUe6cm26jD0ShlORzgTyA0BD7KNiiz6X8mjs:T/siaGUe6cX6jthlORkyA0p7KsA6sUs

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      Horizon V1.3.exe

    • Size

      4.5MB

    • MD5

      28d17aed09e71258fcbb212eda97cd0c

    • SHA1

      ed2a325a250b338f2a645de1221ad47a7cff7386

    • SHA256

      a18aae6764feaa6eb50eb3a80b432c39818406a4346ca4d17ddcf2d36578562e

    • SHA512

      580b7f050dc9b1d52a0707153256e0c93a2c622ba0fe22ac6137601763ef9e031fbc643197a552bbe41cff3ecbfab0606e9c2f925d473cd9859c14c349f0685f

    • SSDEEP

      98304:T/p1o+JaUzUe6cm26jD0ShlORzgTyA0BD7KNiiz6X8mjs:T/siaGUe6cX6jthlORkyA0p7KsA6sUs

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks