Overview

overview

9

Static

static

7

Loader_protected.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    Loader_protected.exe

  • Size

    4.3MB

  • Sample

    240229-avzqnshb6s

  • MD5

    0e80eaa083c9193e52e2bbbd1864446b

  • SHA1

    aaa435e96db1156523b24700b448cc9b8be0cb41

  • SHA256

    1a4218de6f87aeeea348db981c753af1649198240ad6adc214e10d497aad19d5

  • SHA512

    06dd0ec0dd2683d3ca97d77e4814d65e111414858263a3a41dc783cc0f0756d4b378a8221737a8cac8076a00871dde7ab55765c31c9c9930c053a752913f83a6

  • SSDEEP

    98304:kt3KmTDa0b4xGqDh/AngX0vjFMO8TNMS/tqwF63zpxFOtc2Q:c3daaIungAjFYTNdqwQFOtc3

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Loader_protected.exe

    • Size

      4.3MB

    • MD5

      0e80eaa083c9193e52e2bbbd1864446b

    • SHA1

      aaa435e96db1156523b24700b448cc9b8be0cb41

    • SHA256

      1a4218de6f87aeeea348db981c753af1649198240ad6adc214e10d497aad19d5

    • SHA512

      06dd0ec0dd2683d3ca97d77e4814d65e111414858263a3a41dc783cc0f0756d4b378a8221737a8cac8076a00871dde7ab55765c31c9c9930c053a752913f83a6

    • SSDEEP

      98304:kt3KmTDa0b4xGqDh/AngX0vjFMO8TNMS/tqwF63zpxFOtc2Q:c3daaIungAjFYTNdqwQFOtc3

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks