Overview

overview

9

Static

static

7

d26639ca83...0N.exe

windows7-x64

9

d26639ca83...0N.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d26639ca83a0bcd885b85a6919871c20N.exe

  • Size

    4.7MB

  • Sample

    240907-ddmasssala

  • MD5

    d26639ca83a0bcd885b85a6919871c20

  • SHA1

    2bf81d2138756fc6c070220b5e40d336a0303f18

  • SHA256

    d6fbe8ae923a936abb5d4a8746a7f312dbdbda35cdccac1dcb9441d839da86e7

  • SHA512

    f8ffd2d201743ed3bfd2ec83f4e7a04a0a910290eb899af2f5a68d706adc587811973e54d3ee9e0493bb1abf0a9369b2fe600594b4c010b32fb83d3405726122

  • SSDEEP

    98304:OTOXPiMPP20K+aC/ivimh+VxsqbuDsmZ2bYs+DysGi13ckt:OTqan0KjC/i/0zsqIsmZ2bjkysGiJd

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      d26639ca83a0bcd885b85a6919871c20N.exe

    • Size

      4.7MB

    • MD5

      d26639ca83a0bcd885b85a6919871c20

    • SHA1

      2bf81d2138756fc6c070220b5e40d336a0303f18

    • SHA256

      d6fbe8ae923a936abb5d4a8746a7f312dbdbda35cdccac1dcb9441d839da86e7

    • SHA512

      f8ffd2d201743ed3bfd2ec83f4e7a04a0a910290eb899af2f5a68d706adc587811973e54d3ee9e0493bb1abf0a9369b2fe600594b4c010b32fb83d3405726122

    • SSDEEP

      98304:OTOXPiMPP20K+aC/ivimh+VxsqbuDsmZ2bYs+DysGi13ckt:OTqan0KjC/i/0zsqIsmZ2bjkysGiJd

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks