Overview

overview

9

Static

static

7

1649d63956...08.exe

windows7-x64

9

1649d63956...08.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1649d63956459c1aaa9d1e4856ec985798b8762e1d26a4bf24dc147d8efd5408

  • Size

    4.3MB

  • Sample

    240524-ec89lsca46

  • MD5

    eddcfbf29eab630cb154edac3521d17e

  • SHA1

    42fe0fb2705a796bffa348162263a952c9c62679

  • SHA256

    1649d63956459c1aaa9d1e4856ec985798b8762e1d26a4bf24dc147d8efd5408

  • SHA512

    a714ab1a92cdc706d1079c6e02f74438ab682d9d010a960bf7f2f8f0a37d17b718bb4ea55253fe05bac53c979985316d7c6cfc1bfdf10cbd858131658436216e

  • SSDEEP

    98304:AQ7a+V0zMwO7oECepheOLtl3dEeGJMV+tzVoTrxAIhRXrQkwE:J75QMwO7oZeBl3zGJKqkrxLhRJwE

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      1649d63956459c1aaa9d1e4856ec985798b8762e1d26a4bf24dc147d8efd5408

    • Size

      4.3MB

    • MD5

      eddcfbf29eab630cb154edac3521d17e

    • SHA1

      42fe0fb2705a796bffa348162263a952c9c62679

    • SHA256

      1649d63956459c1aaa9d1e4856ec985798b8762e1d26a4bf24dc147d8efd5408

    • SHA512

      a714ab1a92cdc706d1079c6e02f74438ab682d9d010a960bf7f2f8f0a37d17b718bb4ea55253fe05bac53c979985316d7c6cfc1bfdf10cbd858131658436216e

    • SSDEEP

      98304:AQ7a+V0zMwO7oECepheOLtl3dEeGJMV+tzVoTrxAIhRXrQkwE:J75QMwO7oZeBl3zGJKqkrxLhRJwE

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks