Overview

overview

9

Static

static

7

loader.exe

windows10-1703-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    loader.exe

  • Size

    18.2MB

  • Sample

    240223-fdypyabb3t

  • MD5

    7fbfd9d3c34163e491c5cbd6eca5fed8

  • SHA1

    9e463d614de4fbfcd6dcbb9a9197206f4ecc093d

  • SHA256

    299e80bd26e90de2dcf94b5b59aff4201a74acfc1bf2c325847b0124d8583073

  • SHA512

    3829acbbe82cb5f6e2f83d86788a260596fc43808311c12713b2bf4503849e8328f2cea7a90e6ebc79d9b57cc9f91aa2402e160913ae8ff9fcee82e0f11c42ce

  • SSDEEP

    393216:g4frAQhfTmIce0En1DVfN+VwkuveZKkwpvGn4XpmDRx7csDSpLXHwEAstdo3/W:l0Mmh/E1DVfNyuve4tpvGn8q79OpUstL

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      loader.exe

    • Size

      18.2MB

    • MD5

      7fbfd9d3c34163e491c5cbd6eca5fed8

    • SHA1

      9e463d614de4fbfcd6dcbb9a9197206f4ecc093d

    • SHA256

      299e80bd26e90de2dcf94b5b59aff4201a74acfc1bf2c325847b0124d8583073

    • SHA512

      3829acbbe82cb5f6e2f83d86788a260596fc43808311c12713b2bf4503849e8328f2cea7a90e6ebc79d9b57cc9f91aa2402e160913ae8ff9fcee82e0f11c42ce

    • SSDEEP

      393216:g4frAQhfTmIce0En1DVfN+VwkuveZKkwpvGn4XpmDRx7csDSpLXHwEAstdo3/W:l0Mmh/E1DVfNyuve4tpvGn8q79OpUstL

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks