931bd4c37298b48c1c2ea17402934600db39f40d225f53d15a10115cbebd9e89

General

Target
[BFF]iFRPFILE AIO v2.8.6.zip
Size 39.8MB
Sample240320-1n4ddsda8v
SHA256 931bd4c37298b48c1c2ea17402934600db39f40d225f53d15a10115cbebd9e89
MD5 44cc621d5f5051f9207cf1e789a822b4
SHA1 c302ca0eadbefc3b797efee61cc3bb3ee3665ba5
SHA512 c023d0720c9da530451410a938f49492531a15748053001b95801c2c57b314cb2071ff7a417e9e1dd37168ac85e1a731ec0444f863d9d1f19ff64572d9099e47
SSDEEP 786432:zw3BmHsqT2tTJZGGaX7H7QyonnnoOx2IFRXLyUMadeI:zKmvT2whr7QxnndtFkUMadV
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  iFRPFILE AIO v2.8.6/iFRPFILE AIO v2.8.6.exe
- Size 10.5MB
- SHA256 667f8c9bfb3fbbe9e22527cc4f4377397b75e0756876af5824c2518e1a343805
- MD5 549c4d3e3b61e4ff254cbd91dbd68ac6
- SHA1 0ebb5d38acf3644ff61652b0ce66454c162d1ce5
- SHA512 572d8536f8fb586d6de12ce141e9627c7cf421e2e7ed9f6d9504f5320b4bf5c5b91fc428d7226ba776431fc6a171bd349dca3dcc46a88abe1231feb383f63478
- SSDEEP 196608:oAkkqfhjWHAftegXXcUG4raKu24YY7HVT4hV0AD6QgqKRgX:bPHAfFmKr4YYH+EUWpgX
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

agilenet evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2