Overview

overview

9

Static

static

7

XmloXpl6ivdM9LxJ.exe

windows7-x64

9

XmloXpl6ivdM9LxJ.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    XmloXpl6ivdM9LxJ.exe

  • Size

    3.5MB

  • Sample

    240530-ees1eaed96

  • MD5

    1612abd0a7f16f59e864165f57d11fff

  • SHA1

    8fb8a7da37002a87b423bc9a4e020ca2a4708b75

  • SHA256

    b7bfd195ec655a54c1e2dd12a728c2709056887e1657eaf876138e40f03f1fa3

  • SHA512

    b7072754139d6b2604a359c124bd4076fe2d1f532673e953d933cbffc4a89063d0962bfdc1c7359939e1fc9f75134f27f522ebcb17ec5a8a30606099cdca59f6

  • SSDEEP

    98304:wFTOn8omZVj8lQAZi54RmRcmJnX1riXIsea46ZRfMVH:wFyn8HT8qAZs6u7lriZeaRAH

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      XmloXpl6ivdM9LxJ.exe

    • Size

      3.5MB

    • MD5

      1612abd0a7f16f59e864165f57d11fff

    • SHA1

      8fb8a7da37002a87b423bc9a4e020ca2a4708b75

    • SHA256

      b7bfd195ec655a54c1e2dd12a728c2709056887e1657eaf876138e40f03f1fa3

    • SHA512

      b7072754139d6b2604a359c124bd4076fe2d1f532673e953d933cbffc4a89063d0962bfdc1c7359939e1fc9f75134f27f522ebcb17ec5a8a30606099cdca59f6

    • SSDEEP

      98304:wFTOn8omZVj8lQAZi54RmRcmJnX1riXIsea46ZRfMVH:wFyn8HT8qAZs6u7lriZeaRAH

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks