Overview

overview

9

Static

static

7

lmao.rar

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    lmao.rar

  • Size

    19.4MB

  • Sample

    240914-ygs8qsscrn

  • MD5

    daef1c17e11577bcabe74ceec366b4e3

  • SHA1

    6325d337fac9cb91fbe89807fb75387ce2e6e4c1

  • SHA256

    f4c75f66e97391588e6c2c87c59bb951f515fc04187b0fbba8d3b78f8ba86b36

  • SHA512

    cfe0ea0f96acedd41a3cbe3a88454d22eaa7575b48bddd09e5924e41a175f5b8124af0094d151e033b7247490fb1024e721afecb9d83d9ae42fa6722484cc21b

  • SSDEEP

    393216:gH2ExgZOWSfo38qTAMLflnkExp8KM7aAEKRDPpaqEIXhWspu1C1N0uht8:gWxZOU8qTVL9kq8KM7auTwspu1kj8

Score
9/10
discoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      lmao.rar

    • Size

      19.4MB

    • MD5

      daef1c17e11577bcabe74ceec366b4e3

    • SHA1

      6325d337fac9cb91fbe89807fb75387ce2e6e4c1

    • SHA256

      f4c75f66e97391588e6c2c87c59bb951f515fc04187b0fbba8d3b78f8ba86b36

    • SHA512

      cfe0ea0f96acedd41a3cbe3a88454d22eaa7575b48bddd09e5924e41a175f5b8124af0094d151e033b7247490fb1024e721afecb9d83d9ae42fa6722484cc21b

    • SSDEEP

      393216:gH2ExgZOWSfo38qTAMLflnkExp8KM7aAEKRDPpaqEIXhWspu1C1N0uht8:gWxZOU8qTVL9kq8KM7auTwspu1kj8

    Score
    9/10
    discoveryevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks