Overview

overview

9

Static

static

7

loader (1).exe

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader (1).exe

  • Size

    7.6MB

  • Sample

    240824-xa2qvsvgpl

  • MD5

    fed717bcf2d967b93771a0c4d07c397c

  • SHA1

    6facf6531a46f65ac135bd3e5ddb50606bf62871

  • SHA256

    4055ffc497e5a060d6b4c3b31651e5db97f2f4049fb0599cd37d150eaae243a9

  • SHA512

    9cc8b5f1b2bbfbd3d770836f405a8d906b90985107178f19a930bfc0830a508b40cf8aca8434e2df013fba1f42ffb1e99845a74f7cdce553de148ea58cfd5dbc

  • SSDEEP

    196608:dqJH81RAgpzRB2PUhXC5LRlFl1Kk867ZnxgGKdfR6e:ic7A8zRc8tYRV1KKZn6GKD5

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      loader (1).exe

    • Size

      7.6MB

    • MD5

      fed717bcf2d967b93771a0c4d07c397c

    • SHA1

      6facf6531a46f65ac135bd3e5ddb50606bf62871

    • SHA256

      4055ffc497e5a060d6b4c3b31651e5db97f2f4049fb0599cd37d150eaae243a9

    • SHA512

      9cc8b5f1b2bbfbd3d770836f405a8d906b90985107178f19a930bfc0830a508b40cf8aca8434e2df013fba1f42ffb1e99845a74f7cdce553de148ea58cfd5dbc

    • SSDEEP

      196608:dqJH81RAgpzRB2PUhXC5LRlFl1Kk867ZnxgGKdfR6e:ic7A8zRc8tYRV1KKZn6GKD5

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks