General

  • Target

    2aada5ee5e6f67863aa618d5bbd53e0c0f4294f7f81e377bb24de4388f8e1d71

  • Size

    2.5MB

  • Sample

    240611-yq739azckn

  • MD5

    7d6947cb2ebe7cf2c81907379c4efa6c

  • SHA1

    64b9abecc27955de04430e9f43cf8e21570ae63e

  • SHA256

    2aada5ee5e6f67863aa618d5bbd53e0c0f4294f7f81e377bb24de4388f8e1d71

  • SHA512

    f593f0410ab0d90d181435391c223a88d437c6be56545c283b9bce96da37087614f2f4d7c4062ab7a15b79fc547c93c5aa251ad8618f873b0abf4056d5673a0e

  • SSDEEP

    49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx5:gxx9NUFkQx753uWuCyyx5

Malware Config

Targets

    • Target

      2aada5ee5e6f67863aa618d5bbd53e0c0f4294f7f81e377bb24de4388f8e1d71

    • Size

      2.5MB

    • MD5

      7d6947cb2ebe7cf2c81907379c4efa6c

    • SHA1

      64b9abecc27955de04430e9f43cf8e21570ae63e

    • SHA256

      2aada5ee5e6f67863aa618d5bbd53e0c0f4294f7f81e377bb24de4388f8e1d71

    • SHA512

      f593f0410ab0d90d181435391c223a88d437c6be56545c283b9bce96da37087614f2f4d7c4062ab7a15b79fc547c93c5aa251ad8618f873b0abf4056d5673a0e

    • SSDEEP

      49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx5:gxx9NUFkQx753uWuCyyx5

    • Modifies visiblity of hidden/system files in Explorer

    • Detects executables packed with Themida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks