Overview

overview

9

Static

static

7

External.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    External.exe

  • Size

    4.0MB

  • Sample

    240425-1sp2kafe9x

  • MD5

    46e6208e526206030b862b39cc91e31f

  • SHA1

    3251f3e75e5a4e967c97148a4e6a08bb98b92202

  • SHA256

    cf0e05199495a70585dc809f0f91763c51bb9a1345c3e9cf3d53a9e49a49347f

  • SHA512

    d1f951d9f3f3e3202fa91569ff3d2dfda16393e8df1589f96e888fe5eeea850cdd8d28debea938931d7a52487fab0484ef96f17a5bfa4eea1d260d43c147af89

  • SSDEEP

    98304:JaGsbS8Q5AVU5Tkkp+C2F5cSCyClKCjYKORmTLWK3b:JaGsu8KAVaNUC2ncSCzG2LXr

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      External.exe

    • Size

      4.0MB

    • MD5

      46e6208e526206030b862b39cc91e31f

    • SHA1

      3251f3e75e5a4e967c97148a4e6a08bb98b92202

    • SHA256

      cf0e05199495a70585dc809f0f91763c51bb9a1345c3e9cf3d53a9e49a49347f

    • SHA512

      d1f951d9f3f3e3202fa91569ff3d2dfda16393e8df1589f96e888fe5eeea850cdd8d28debea938931d7a52487fab0484ef96f17a5bfa4eea1d260d43c147af89

    • SSDEEP

      98304:JaGsbS8Q5AVU5Tkkp+C2F5cSCyClKCjYKORmTLWK3b:JaGsu8KAVaNUC2ncSCzG2LXr

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks