Overview

overview

9

Static

static

7

TelegramExpert.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TelegramExpert.exe

  • Size

    17.4MB

  • Sample

    240522-pc7qwshd65

  • MD5

    99974195d2ace89ba50ccb692cd74cae

  • SHA1

    b54132da35de58c4bb6502de0b86167a8bec2b05

  • SHA256

    f7e5c0accdfa631517ebc1001a3211e4b07f72743f6ea2129cb880513331814d

  • SHA512

    d6cf9aa60df3d9ed9c1631950abf93f00fe8bd46a81cf5645101bda76ce241eadb48ee995862f6d3855443e47c7ba6e35c72b0b41a803a05d5516a90ef125106

  • SSDEEP

    393216:wzUxz5fJadpnKckVODi91Heim0L5UdSWIp9K58k9DHJEyhcMECAdvL++mxrL4xga:EsfJ0xKc0ODa1+izUdSWu9KSWHpcMEC0

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      TelegramExpert.exe

    • Size

      17.4MB

    • MD5

      99974195d2ace89ba50ccb692cd74cae

    • SHA1

      b54132da35de58c4bb6502de0b86167a8bec2b05

    • SHA256

      f7e5c0accdfa631517ebc1001a3211e4b07f72743f6ea2129cb880513331814d

    • SHA512

      d6cf9aa60df3d9ed9c1631950abf93f00fe8bd46a81cf5645101bda76ce241eadb48ee995862f6d3855443e47c7ba6e35c72b0b41a803a05d5516a90ef125106

    • SSDEEP

      393216:wzUxz5fJadpnKckVODi91Heim0L5UdSWIp9K58k9DHJEyhcMECAdvL++mxrL4xga:EsfJ0xKc0ODa1+izUdSWu9KSWHpcMEC0

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks