70b154061120bf9243c35173b59e6a245536885c849d91dd74c6dc9eab160985

Resubmissions

30/05/2024, 12:34

240530-prxt8saa469

30/05/2024, 06:32

240530-has2dsad759

30/05/2024, 05:51

240530-gj8b1ahf739

Sharing

Copy URL Twitter E-mail

General

Target
GmloXpl6ivdM9LxS.exe
Size 3.9MB
Sample240530-has2dsad75
SHA256 70b154061120bf9243c35173b59e6a245536885c849d91dd74c6dc9eab160985
MD5 f6ce0674c39383949e15b659c8814ddf
SHA1 96628729ba4d22e2fac8cc709fbf096ba2867515
SHA512 24c1d738f2f2c6e03daafc092ddce9f3629bb643c57730bbd445788c4b727d0107079481201dbad725c45b1020c86bd391e4de9b8ddc1656b586c3b9e0897f24
SSDEEP 98304:aMm8yEWuHI6WhzQMdrRCNyG54UA1T2vuzE:PgeH94zddQkpQuzE
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  GmloXpl6ivdM9LxS.exe
- Size 3.9MB
- SHA256 70b154061120bf9243c35173b59e6a245536885c849d91dd74c6dc9eab160985
- MD5 f6ce0674c39383949e15b659c8814ddf
- SHA1 96628729ba4d22e2fac8cc709fbf096ba2867515
- SHA512 24c1d738f2f2c6e03daafc092ddce9f3629bb643c57730bbd445788c4b727d0107079481201dbad725c45b1020c86bd391e4de9b8ddc1656b586c3b9e0897f24
- SSDEEP 98304:aMm8yEWuHI6WhzQMdrRCNyG54UA1T2vuzE:PgeH94zddQkpQuzE
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2