Overview

overview

10

Static

static

3

PhantomSolutions.exe

windows7-x64

8

PhantomSolutions.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PhantomSolutions.exe

  • Size

    4.2MB

  • Sample

    240620-elb1gaxfnf

  • MD5

    09ba36b3539981f4f69de454cb97c0df

  • SHA1

    53ec52c277921e020770e54450988df8189378de

  • SHA256

    f976368908d75ad474cb16762742852803ae91d1727197a80e9c55ec9e910b89

  • SHA512

    8f6a533a930e7b7285afc0ce87b57f147db6a73322263fd762b097f73a6d232237d907b8b0e3ebd57da568a618267d6f2d9cf33d00d1b729d86f20bba8be32e6

  • SSDEEP

    98304:7d7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6K:o+y4ihkl/Wo/afHP

Score
10/10
cerberevasionexecutionransomwarethemidatrojan

Malware Config

Targets

    • Target

      PhantomSolutions.exe

    • Size

      4.2MB

    • MD5

      09ba36b3539981f4f69de454cb97c0df

    • SHA1

      53ec52c277921e020770e54450988df8189378de

    • SHA256

      f976368908d75ad474cb16762742852803ae91d1727197a80e9c55ec9e910b89

    • SHA512

      8f6a533a930e7b7285afc0ce87b57f147db6a73322263fd762b097f73a6d232237d907b8b0e3ebd57da568a618267d6f2d9cf33d00d1b729d86f20bba8be32e6

    • SSDEEP

      98304:7d7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6K:o+y4ihkl/Wo/afHP

    Score
    10/10
    evasionexecutioncerberransomwarethemidatrojan

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Stops running service(s)

      evasionexecution

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks