5d2cccfe7a81853b04f8554ff93170a9f616dd63ac4cee69d86b0341b8419ca8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49def96963ebd24e9d4f6c8fd648f837_JaffaCakes118
Size

5.0MB
Sample

240715-p6gfssscll
MD5

49def96963ebd24e9d4f6c8fd648f837
SHA1

e02482c7c0d0a7327c7a3a879089f846ddc62888
SHA256

5d2cccfe7a81853b04f8554ff93170a9f616dd63ac4cee69d86b0341b8419ca8
SHA512

37699e8dcc47151e1ab0cfd86fbd4ec65109260dfedc70539c89e5e30e63231c55f48e9a3692a7efa750333b86a7934d2ca0bdec1d2712c136c547ded1f72482
SSDEEP

98304:JIxu3vRkYbAKQIeS3igCR3WE1re1bOtGodzAED1yFcV5c:JIs3atKQj0E1r0bOtZdM5H

Score

9^/10

evasion themida trojan

Malware Config

Targets

- Target
  
  49def96963ebd24e9d4f6c8fd648f837_JaffaCakes118
- Size
  
  5.0MB
- MD5
  
  49def96963ebd24e9d4f6c8fd648f837
- SHA1
  
  e02482c7c0d0a7327c7a3a879089f846ddc62888
- SHA256
  
  5d2cccfe7a81853b04f8554ff93170a9f616dd63ac4cee69d86b0341b8419ca8
- SHA512
  
  37699e8dcc47151e1ab0cfd86fbd4ec65109260dfedc70539c89e5e30e63231c55f48e9a3692a7efa750333b86a7934d2ca0bdec1d2712c136c547ded1f72482
- SSDEEP
  
  98304:JIxu3vRkYbAKQIeS3igCR3WE1re1bOtGodzAED1yFcV5c:JIs3atKQj0E1r0bOtZdM5H
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionthemidatrojan

behavioral2

evasionthemidatrojan