Overview

overview

9

Static

static

7

pribate.exe

windows7-x64

9

pribate.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pribate.exe

  • Size

    5.6MB

  • Sample

    240708-ab9rjavenb

  • MD5

    d00796d52b036d5ee320b91e974037da

  • SHA1

    329a385031c8220bb7d9bd6b935a420f23dd7385

  • SHA256

    bcef64f477021a9b6953539a83a528cc4af7e1b43b5c5f7c94a7083d35eed287

  • SHA512

    1e7621cb8a7230fac2958ee9ac4f65939ccb851f57bc76fa0954e5342f07aabb19e0d4d805e52c454aea0fc5dba6ffd07aa0370283dad95e208d2d5e3d68182c

  • SSDEEP

    98304:/Zj9cgkAi79yfbZD+jR1/Yy/MVXVVyLVFhvVTZLoywHkHWuJTO6kyT:ggJIyfb4jRVYRVbyLvZLIk2uJTNHT

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      pribate.exe

    • Size

      5.6MB

    • MD5

      d00796d52b036d5ee320b91e974037da

    • SHA1

      329a385031c8220bb7d9bd6b935a420f23dd7385

    • SHA256

      bcef64f477021a9b6953539a83a528cc4af7e1b43b5c5f7c94a7083d35eed287

    • SHA512

      1e7621cb8a7230fac2958ee9ac4f65939ccb851f57bc76fa0954e5342f07aabb19e0d4d805e52c454aea0fc5dba6ffd07aa0370283dad95e208d2d5e3d68182c

    • SSDEEP

      98304:/Zj9cgkAi79yfbZD+jR1/Yy/MVXVVyLVFhvVTZLoywHkHWuJTO6kyT:ggJIyfb4jRVYRVbyLvZLIk2uJTNHT

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks