General

  • Target

    560688888a1a43907c7acdfa965ba262b5633d5bab650b8a2d5f9f6f16d06a94

  • Size

    2.5MB

  • Sample

    240610-pgb5sabb54

  • MD5

    5b0aa667faa73f3f2527aefcc08a9c3b

  • SHA1

    afb5c3c90e9de8f6e2314be70390ecb1c808bc6f

  • SHA256

    560688888a1a43907c7acdfa965ba262b5633d5bab650b8a2d5f9f6f16d06a94

  • SHA512

    7a902df5b47b57aab78924e41cee449b3843869665c068b7a610c12469514b85efb879d456ca3ef97fb4448d9453031a2389ed4eab6c78113234bcf0cf2aa764

  • SSDEEP

    49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:gxx9NUFkQx753uWuCyyxg

Malware Config

Targets

    • Target

      560688888a1a43907c7acdfa965ba262b5633d5bab650b8a2d5f9f6f16d06a94

    • Size

      2.5MB

    • MD5

      5b0aa667faa73f3f2527aefcc08a9c3b

    • SHA1

      afb5c3c90e9de8f6e2314be70390ecb1c808bc6f

    • SHA256

      560688888a1a43907c7acdfa965ba262b5633d5bab650b8a2d5f9f6f16d06a94

    • SHA512

      7a902df5b47b57aab78924e41cee449b3843869665c068b7a610c12469514b85efb879d456ca3ef97fb4448d9453031a2389ed4eab6c78113234bcf0cf2aa764

    • SSDEEP

      49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:gxx9NUFkQx753uWuCyyxg

    • Modifies visiblity of hidden/system files in Explorer

    • Detects executables packed with Themida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks