Overview

overview

9

Static

static

7

4f8f280ae5...ae.exe

windows7-x64

9

4f8f280ae5...ae.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f8f280ae5dbb931d0b79cba30b912698831dd17b7cf146348642ecbcf90eeae

  • Size

    8.6MB

  • Sample

    240522-qmkjsach9z

  • MD5

    bcb0efeb03ab1b4d32d6043f7a223719

  • SHA1

    c5933dcb5d2b4510dc2b61650fd544073da19f88

  • SHA256

    4f8f280ae5dbb931d0b79cba30b912698831dd17b7cf146348642ecbcf90eeae

  • SHA512

    e6aa13e4ea95f21b477b802cc97d4bbfb2f6a908482cdfe08095df2cf83799827335f7fa920ab56016c08c9e849739ac2ce81b4285f4cc68929fff2e33023b4d

  • SSDEEP

    196608:VCO0Bg8tEXBAw4ov3Vhqx3nChywSH9QBOltYDKzwHTK7lHXxv:Vn0BlwBj4ov3VoyhywsaKE+7lH

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      4f8f280ae5dbb931d0b79cba30b912698831dd17b7cf146348642ecbcf90eeae

    • Size

      8.6MB

    • MD5

      bcb0efeb03ab1b4d32d6043f7a223719

    • SHA1

      c5933dcb5d2b4510dc2b61650fd544073da19f88

    • SHA256

      4f8f280ae5dbb931d0b79cba30b912698831dd17b7cf146348642ecbcf90eeae

    • SHA512

      e6aa13e4ea95f21b477b802cc97d4bbfb2f6a908482cdfe08095df2cf83799827335f7fa920ab56016c08c9e849739ac2ce81b4285f4cc68929fff2e33023b4d

    • SSDEEP

      196608:VCO0Bg8tEXBAw4ov3Vhqx3nChywSH9QBOltYDKzwHTK7lHXxv:Vn0BlwBj4ov3VoyhywsaKE+7lH

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks