Overview

overview

10

Static

static

7

fcd465bfb2...d3.exe

windows7-x64

10

fcd465bfb2...d3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cb4118382e3f97f0db04938a4e31e3e1.bin
  • Size 3.8MB
  • Sample240422-ce2lfaeb32
  • SHA256 3a6610abad08c3e14c04f797c11d6723f8db2131593e83274744a01347415c2d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionthemidatrojan

Malware Config

Targets

    • Target
      fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe
    • Size 4.1MB
    • SHA256 fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    evasionthemidatrojan

    • Modifies firewall policy service

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks