503a872b7d327c4af5f7d1f39670ae0beb834adbe2edea89aeaa5327e2d8433b

General

Target

release8-7.rar
Size

8.2MB
Sample

240808-wywn3s1blg
MD5

314c7b942fc8040638b4aa69dd2620e8
SHA1

f30f431a640a00cf57c49923250dad9fcb69df8d
SHA256

503a872b7d327c4af5f7d1f39670ae0beb834adbe2edea89aeaa5327e2d8433b
SHA512

57da9a4e991488f8651846e43b12889c863753e8034d75d98e9dba9c6c10596343b13de5541e538942b69940a21f0ac35c466c67ea07a980dba6b3535a796b1e
SSDEEP

196608:nogS+lSAT99DPVFusIjkxAvGUFi0gpuKLoqizxw1wT:noOltDPV45cA+UA0gxLonzR

Score

9^/10

Malware Config

Targets

- Target
  
  release/main/cheat.exe
- Size
  
  4.0MB
- MD5
  
  936ac4a41d17a6b52db3f11beba9841f
- SHA1
  
  3f8dfc71a9d1f465dc20722a0641a5f782186a14
- SHA256
  
  15b4fa011ed35143b71d9168d38f8ad9a7014273dd10a6592dd688363855f877
- SHA512
  
  b2fa988a62eefa08e1894eb36ba8c28a53ba9f27ed5cfd5dbb2eac2f771a095ea3900eaa97dbb4bc6cf0aa4250febc9d87d4e3f21cf98ea28444394822e5b09a
- SSDEEP
  
  98304:PiTRfWnc5atuwKwN0tl/S5dwyszTeGLshGNW3u3LC7I3K8suGNGTZ:qTknq8fb0tg5dwyszCGLssNgku7D8suV
Score

9^/10

evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  release/main/loader.exe
- Size
  
  4.1MB
- MD5
  
  9ecdc9ed1bea6c226f92d740d43400b9
- SHA1
  
  b5b5066cd4284733d8c3f3d7de3ca6653091ae10
- SHA256
  
  60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
- SHA512
  
  30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
- SSDEEP
  
  98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  
  release/map/Map.exe
- Size
  
  416KB
- MD5
  
  36c50332466b6e921edb79ea4b240278
- SHA1
  
  5b858fb375235e7638b7cef22ca972d27ce9cacc
- SHA256
  
  0a76f7d189b368598ee017d0094a6698ffff66d0f981f85769971170ca29e042
- SHA512
  
  fbc23c9d21e9dd3fbb7eac87fcee7e9db52d6c6450402ec90a7ba43940029af00d4ab9db8f0e662f30d8f99a34326673f26051932e2ae7afcfb377d053f4cc41
- SSDEEP
  
  12288:rbNG38Jf2mCsCTyTH8+vtQ7BWD24cVLxSf0:rbNG38Jf2mCsCTMc+laBH4cVLxSf
Score

8^/10

persistence defense_evasion
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6