Overview

overview

9

Static

static

7

v4fjnmwnyNoy.exe

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    v4fjnmwnyNoy.exe

  • Size

    6.5MB

  • Sample

    240619-1eadysxbmn

  • MD5

    da1fe7be94d1eb5e9a5a988d4d1317dd

  • SHA1

    3de11dc6b172aa714578798d2109dea500a9d50e

  • SHA256

    84f476ec3a920a2c166260af00e5388f84f97033d0e6a3b4d0ea8e39a69eb3ea

  • SHA512

    75dbbedc4182f55d284310461bffeb745d5eb2b6c605cdb13bd75b5e52d485c8e3315b39d4b4ec03710dd5f29b91ee2db962c41c0cdc6e6084dca010f5b544f4

  • SSDEEP

    196608:thWjFTf3I4CbOYPD1q8wdhlBWfyTzHQqSo1:tc58J6Y1BwLl8yT7So

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      v4fjnmwnyNoy.exe

    • Size

      6.5MB

    • MD5

      da1fe7be94d1eb5e9a5a988d4d1317dd

    • SHA1

      3de11dc6b172aa714578798d2109dea500a9d50e

    • SHA256

      84f476ec3a920a2c166260af00e5388f84f97033d0e6a3b4d0ea8e39a69eb3ea

    • SHA512

      75dbbedc4182f55d284310461bffeb745d5eb2b6c605cdb13bd75b5e52d485c8e3315b39d4b4ec03710dd5f29b91ee2db962c41c0cdc6e6084dca010f5b544f4

    • SSDEEP

      196608:thWjFTf3I4CbOYPD1q8wdhlBWfyTzHQqSo1:tc58J6Y1BwLl8yT7So

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks