a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f | Triage

Submit
Reports

Overview

overview

9

Static

static

7

a573a413cb...8f.dll

windows7-x64

9

a573a413cb...8f.dll

windows10-2004-x64

9

Sharing

General

Target

a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f
Size

2.4MB
Sample

240410-qfc65agh22
MD5

5bf9b9d44414ca71dfd7159b00cbc8d6
SHA1

7bee238bbf995a118c1cd22299cfab8732d71eb2
SHA256

a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f
SHA512

2ac034181a8be1d28d5fdcda6ac60ca2f51bb8a477f294804800fec5d54633064e5fa0be7ad82cec27164242ba5f6aafaa15ac8336d9054af88ec2186ea3f6a2
SSDEEP

49152:U1Y60SANj4KrFakICZnim2Ybv9e9xEoyiUJMJVnuJG:STyJrFaknl2Yjynu0

Score

9^/10

evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f.dll

Resource

win7-20231129-en

evasion themida trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f.dll

Resource

win10v2004-20240319-en

evasion themida trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f
- Size
  
  2.4MB
- MD5
  
  5bf9b9d44414ca71dfd7159b00cbc8d6
- SHA1
  
  7bee238bbf995a118c1cd22299cfab8732d71eb2
- SHA256
  
  a573a413cbb1694d985376788d42ab2b342e6ce94dd1599602b73f5cca695d8f
- SHA512
  
  2ac034181a8be1d28d5fdcda6ac60ca2f51bb8a477f294804800fec5d54633064e5fa0be7ad82cec27164242ba5f6aafaa15ac8336d9054af88ec2186ea3f6a2
- SSDEEP
  
  49152:U1Y60SANj4KrFakICZnim2Ybv9e9xEoyiUJMJVnuJG:STyJrFaknl2Yjynu0
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionthemidatrojan

behavioral2

evasionthemidatrojan

© 2018-2025

Terms | Privacy