Overview

overview

9

Static

static

7

sigima.exe

windows7-x64

9

sigima.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sigima.exe

  • Size

    3.9MB

  • Sample

    240726-bs3vzs1akh

  • MD5

    032496eafa4a0b110d8c37b4c995228c

  • SHA1

    3531c2a5723be8a775a1784e434a9c8943ba4f1a

  • SHA256

    e9ebb65e312f6e7ecd0d3637c85b64e18ff92949a740f98deeba23d415c14c0c

  • SHA512

    ceafb86a8a5810343bcdcaacb627555a7c31347c8d08deef19fe19f3449ead663ea3c81bcdcad52484552070f4a454bd0ca0507b0aef002ed61eaaa1a0a0a884

  • SSDEEP

    98304:VFkMoq8JwkyKiWnA7FJ1I8j5haEdt9iDMDN:0i8/yKOJd/ZdtQoDN

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      sigima.exe

    • Size

      3.9MB

    • MD5

      032496eafa4a0b110d8c37b4c995228c

    • SHA1

      3531c2a5723be8a775a1784e434a9c8943ba4f1a

    • SHA256

      e9ebb65e312f6e7ecd0d3637c85b64e18ff92949a740f98deeba23d415c14c0c

    • SHA512

      ceafb86a8a5810343bcdcaacb627555a7c31347c8d08deef19fe19f3449ead663ea3c81bcdcad52484552070f4a454bd0ca0507b0aef002ed61eaaa1a0a0a884

    • SSDEEP

      98304:VFkMoq8JwkyKiWnA7FJ1I8j5haEdt9iDMDN:0i8/yKOJd/ZdtQoDN

    Score
    9/10
    evasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks