47b802f035c557bebad7c4392d61948b1d768e7697af6509f1ced4b5cbc58bb3

General

Target

release7-17.rar
Size

8.4MB
Sample

240720-v5w3rawekl
MD5

7a1fbd7bd07086c12883c68244043dc9
SHA1

0e43283f344aa538427674e674e25e19e4f9a4ff
SHA256

47b802f035c557bebad7c4392d61948b1d768e7697af6509f1ced4b5cbc58bb3
SHA512

735e5b5f834b2a210ad07de5cb59d4606cc359745d25ff53ca571069461cd20ab69288ab6f94fb57ee767153398b8af0663422cc153f0caffa5ab6c8b0f3930f
SSDEEP

196608:qOBuMgo84mz+f1DEb2tuTxAvGUFi0gpuKLoqizxw1wo:TUz+f1RUA+UA0gxLonza

Score

9^/10

Malware Config

Targets

- Target
  
  release/main/cheat.exe
- Size
  
  4.2MB
- MD5
  
  a30028b0ea588ce319b5a43b36770e78
- SHA1
  
  e712ff80e4ee0dfe8ee81b99ef690689a8991181
- SHA256
  
  28ad19883cb42f08fd9489cdc967ba1dc4e4720e97b1402b08d0f9506656454c
- SHA512
  
  7c7f83a545d99cd656a0548879233c5a464e5b057c82dbad10d08ca816fdf7ece98d416d5dabdae4c6868f3712438fe0c4bc326f64578cd3aa1652487af2c8de
- SSDEEP
  
  98304:ut4ovXJgFqXexki8wywAFX31GLSdfajrrAzuoVMn:U40+8XTdwg31+SAjroWn
Score

9^/10

evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  release/main/loader.exe
- Size
  
  4.1MB
- MD5
  
  9ecdc9ed1bea6c226f92d740d43400b9
- SHA1
  
  b5b5066cd4284733d8c3f3d7de3ca6653091ae10
- SHA256
  
  60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
- SHA512
  
  30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
- SSDEEP
  
  98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  
  release/map/Map.exe
- Size
  
  416KB
- MD5
  
  36c50332466b6e921edb79ea4b240278
- SHA1
  
  5b858fb375235e7638b7cef22ca972d27ce9cacc
- SHA256
  
  0a76f7d189b368598ee017d0094a6698ffff66d0f981f85769971170ca29e042
- SHA512
  
  fbc23c9d21e9dd3fbb7eac87fcee7e9db52d6c6450402ec90a7ba43940029af00d4ab9db8f0e662f30d8f99a34326673f26051932e2ae7afcfb377d053f4cc41
- SSDEEP
  
  12288:rbNG38Jf2mCsCTyTH8+vtQ7BWD24cVLxSf0:rbNG38Jf2mCsCTMc+laBH4cVLxSf
Score

8^/10

persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
behavioral3