Overview

overview

7

Static

static

7

PWMultiHac...HF.dll

windows7-x64

1

PWMultiHac...HF.dll

windows10-2004-x64

1

PWMultiHac...k3.exe

windows7-x64

7

PWMultiHac...k3.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca021d74aa2e93ef4709312cd40f5a06

  • Size

    1.4MB

  • Sample

    240315-anc84abf5w

  • MD5

    ca021d74aa2e93ef4709312cd40f5a06

  • SHA1

    c310a1fcc831056929c917ed06f2c414523e2cae

  • SHA256

    caa8a696fe19ac95f7cc034bf1e88e2595f40e5963e6e0fa1b17bec055b552f5

  • SHA512

    c695cf32a842698a52608484d35969d875298042bd7e608526f86d869e929827fd085f10df49f775df5936238f6aa4e2e6fc6903b72f4a3ad5a6dd3c78ef8a13

  • SSDEEP

    24576:+I6TSkwLfwFrfWTif6vERhOnoLbRNVzGcnLhD0BY1+5Y99tEguzbQ1w2Rcp5mHUW:yG61pfOIYnoLbpzGcL10BO+K99tVuXQD

Score
7/10
evasionthemida

Malware Config

Targets

    • Target

      PWMultiHack3/DinmaiteHF.dll

    • Size

      148KB

    • MD5

      3b3b757cced57651b5f22910d38fe75e

    • SHA1

      e237a9b9b8e3b9ee752762facb7bd701d077949a

    • SHA256

      84bb694183da6702f19dbcc4c44d5fdec561a1d85d8d5d85ee5321454252a9bc

    • SHA512

      e41cfa0292156b7abc7d08958a3f6f66e4ef92d3ed8f003c24fe978a31fb5d41e898c2b702109ab44bd96e1ca0f89f8603a826355f3e6329fad928b0bec508df

    • SSDEEP

      3072:6zC/cxa2Zw6hdH5t7KopghBTdYZRAZDixqirfOqH1lxRASPr:62/AhzzHPWh5dYrAZiPqqH5RdP

    Score
    1/10
    behavioral1behavioral2

    • Target

      PWMultiHack3/PWMultyHack3.exe

    • Size

      1.5MB

    • MD5

      75f97782aeac893edfef0e231669e627

    • SHA1

      7c1f5ba533663c36a93a24ad2f438822a1b07b6c

    • SHA256

      35ef48401c775aa87c6e64c96aef7a5690a7622e1d241f204e6b94a7ff1120c0

    • SHA512

      a7edebc2f86b670cec4b6472678ddc27ba2e2641e9718a61d9abea3fa3ad7dff1c19c4e222ef8f331bd109becfeda68b643c050f4ba87c34dbe3669ad828d2f4

    • SSDEEP

      24576:VKpXBJjl2EM1AwIR/DfO8bmym9ywulK/NZxekD8u9nTe1e4L5plYDXJA8ZE:V6JjlnJdmRyjI8kQ1e4Fp8+8Z

    Score
    7/10
    evasionthemida

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks