Overview

overview

9

Static

static

7

F87ED5926D...AE.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    F87ED5926D4B89E4473603FA7A7F9BA73A0480DABF8536A15481371234E1D7AE.zip

  • Size

    6.0MB

  • Sample

    240507-mjcszscb6t

  • MD5

    8a30dae2190b63a1a107051ee02f3445

  • SHA1

    91f1a9b06e36bf82a081f3acaf895cc202175d87

  • SHA256

    f9e55b462180a3b3723631de80adae899a8e04d1a5e2e3b8a8f6f9c00cc34ff2

  • SHA512

    0c02d52121ab01aa931dfb3c6a6766c669a17e1173012cc48e1464b34b913030482984169172f7bdd37f4e64b6404ee8351617b0dbce5956456aed609fa756aa

  • SSDEEP

    98304:StiW1NuAwyH8rb0Z2zL/N/ddBAAC7cBe0rK1gzriA1f5tdY26jy7Lswxwm:StiuNDwoCb0UX/N1nB6gXiAbJ6jy7L2m

Score
9/10
agilenetevasionthemidatrojan

Malware Config

Targets

    • Target

      F87ED5926D4B89E4473603FA7A7F9BA73A0480DABF8536A15481371234E1D7AE

    • Size

      6.0MB

    • MD5

      d4119d6b2c67253980444fffbee626aa

    • SHA1

      2832d4692c01356e4ea6b6a761353021435d74d5

    • SHA256

      f87ed5926d4b89e4473603fa7a7f9ba73a0480dabf8536a15481371234e1d7ae

    • SHA512

      821bccb2542cf538838fd3ca38fc4c16375e15ded12754a2d4d55f22410cc42d63f14bc8a0f93a79ae177d6668e11889eb6d3f3db4e0c7d146005a5552a84706

    • SSDEEP

      98304:FYaIkxWPEOnA0XjEhJr9/lfi7oh2B6RkNmMrTfp7ZP4Gx9SSNH8e0LXZlIz76/:F/IGiEOA599fO76RErzp7VBTF0TZlCA

    Score
    9/10
    agilenetevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks