Overview

overview

9

Static

static

7

HorizonUpdated.exe

windows7-x64

9

HorizonUpdated.exe

windows10-2004-x64

9

Resubmissions

28-08-2024 20:00

240828-yq42laverq 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HorizonUpdated.exe

  • Size

    6.2MB

  • Sample

    240828-yq42laverq

  • MD5

    85d153363588cad0dd5c3ea1d26bddbb

  • SHA1

    c7a23d27cdebfc2417b270fa219e11cd84fdf22b

  • SHA256

    2c90f6122311e85fb93348cf3d204ed85f85e59730dce45dfd1761d7adf9d5d5

  • SHA512

    06c826fab50ff392e84de07d937024debb622882044cca7c1272820d682415d1eb7e8beeff66e95452396878f5e6c944adb2e62c46a4ecbff88a670b511a23ff

  • SSDEEP

    196608:9C6mXpAzaps4JqfzBCXj6z14oNcqYjLSySrn:9dmZbSHq+pDNAPe

Score
9/10
discoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      HorizonUpdated.exe

    • Size

      6.2MB

    • MD5

      85d153363588cad0dd5c3ea1d26bddbb

    • SHA1

      c7a23d27cdebfc2417b270fa219e11cd84fdf22b

    • SHA256

      2c90f6122311e85fb93348cf3d204ed85f85e59730dce45dfd1761d7adf9d5d5

    • SHA512

      06c826fab50ff392e84de07d937024debb622882044cca7c1272820d682415d1eb7e8beeff66e95452396878f5e6c944adb2e62c46a4ecbff88a670b511a23ff

    • SSDEEP

      196608:9C6mXpAzaps4JqfzBCXj6z14oNcqYjLSySrn:9dmZbSHq+pDNAPe

    Score
    9/10
    discoveryevasionthemidatrojanpersistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks