Overview

overview

9

Static

static

7

Archive.zip

windows11-21h2-x64

9

Resubmissions

26-05-2024 22:46

240526-2p1jkaeh4v 9

26-05-2024 22:42

240526-2mse6seg5t 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archive.zip

  • Size

    61.0MB

  • Sample

    240526-2mse6seg5t

  • MD5

    70116103e7553b96c70656be0af4cc8e

  • SHA1

    33335c7c4d77a7885a45cda780aaaa43ba22cb8b

  • SHA256

    85222b8aa357eaeacf646a333687ee382ac4b4cfdfe44134fd3369763174cb52

  • SHA512

    100869eb93392b7acc778ae1af1a076c21170a04a8698495c7792bff2ff00b22fc1795c72e70213c003527f23f20cf2d2d0bb204b5801cb9cc7aa19cebdf529c

  • SSDEEP

    1572864:JCEKXwK/K4bHPMbfsVwZTx9PuPl/Fjq1ADsPUyoa+IxDeAsArSZGamr:SXw9AH8jx90Fq1wUNheAPaGf

Score
9/10
evasionpyinstallerthemidatrojan

Malware Config

Targets

    • Target

      Archive.zip

    • Size

      61.0MB

    • MD5

      70116103e7553b96c70656be0af4cc8e

    • SHA1

      33335c7c4d77a7885a45cda780aaaa43ba22cb8b

    • SHA256

      85222b8aa357eaeacf646a333687ee382ac4b4cfdfe44134fd3369763174cb52

    • SHA512

      100869eb93392b7acc778ae1af1a076c21170a04a8698495c7792bff2ff00b22fc1795c72e70213c003527f23f20cf2d2d0bb204b5801cb9cc7aa19cebdf529c

    • SSDEEP

      1572864:JCEKXwK/K4bHPMbfsVwZTx9PuPl/Fjq1ADsPUyoa+IxDeAsArSZGamr:SXw9AH8jx90Fq1wUNheAPaGf

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks