9b7b8fb2dd6e26c287c808d9fb30522cc0b60589548e2b8f51641f206abb933e

General

Target

F.U.N.rar
Size

8.1MB
Sample

240425-ggwv7agc72
MD5

d76e38bbb8dd6078b496d52bdb050cd1
SHA1

ef8430115d01d8edeb5da56c6b7615d4e1374cd7
SHA256

9b7b8fb2dd6e26c287c808d9fb30522cc0b60589548e2b8f51641f206abb933e
SHA512

8dafe93cdeac2223fc0b53a2554b5cb6de3999ca366f317758f6414f3e8b214d815ae3048e7e9d3f1cac48eab6b0d2383287bfe243f0628f433d8bfa0f3bacb6
SSDEEP

196608:qe5ejLwmpLIzrv9sQVLUh+oy/TcLS9ypLYLhbNAEU:qyGO9s2LLotLRVA/FU

Score

9^/10

Malware Config

Targets

- Target
  
  F.U.N/cheeto.exe
- Size
  
  4.0MB
- MD5
  
  b8b60acb20f53ae203618b45b0578aba
- SHA1
  
  3239d80231be7fa4239a20e050dc77b9b56d55db
- SHA256
  
  9021310ff661bc1760fe8438a3556691d2f0f11731fdd155cfcf63c525dceecc
- SHA512
  
  a925efed5af0f00aab12442daf92a74b371e2397ddbfd939b7311d4c9cde8b6589e38925f8a58c80efdb208c160fc41a7aaaea4c18977b454039caec1403b0c6
- SSDEEP
  
  98304:zngUg1mGHWBgkNaSJX05PSMHtZtYx70NsRasp0U5LY82:KmGHy9LR056MHtnYx70NsRj2
Score

9^/10

evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  F.U.N/loader.exe
- Size
  
  4.1MB
- MD5
  
  9ecdc9ed1bea6c226f92d740d43400b9
- SHA1
  
  b5b5066cd4284733d8c3f3d7de3ca6653091ae10
- SHA256
  
  60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
- SHA512
  
  30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
- SSDEEP
  
  98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2