Overview

overview

9

Static

static

7

Loader.exe

windows7-x64

9

Loader.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    5.0MB

  • Sample

    240930-nhqh5axaph

  • MD5

    cf8ecc93a3848a0f1af2d86a7583fa7b

  • SHA1

    0c3a2f0c232269fd606cbc5878e79a9a7e9f5ad2

  • SHA256

    2194e86e58b755f6e198fbcd1da59c59d407640ee546016511571a2831aed428

  • SHA512

    4d51419d732e76b8957c94410eb0c2fb983a294b114b37f3e3eb6601917f119d519b235449a97aa720b05bbb57b6a058bf9a33e6f3167200c1d70e785ae335e2

  • SSDEEP

    98304:xIyGHl0VF6q/BtGiCtRdIDGIQc3VMOr4r1JLdwS2z9ZJ9xiQ:xLxVFNJtGi2IDGIQcelz89ZJDd

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      5.0MB

    • MD5

      cf8ecc93a3848a0f1af2d86a7583fa7b

    • SHA1

      0c3a2f0c232269fd606cbc5878e79a9a7e9f5ad2

    • SHA256

      2194e86e58b755f6e198fbcd1da59c59d407640ee546016511571a2831aed428

    • SHA512

      4d51419d732e76b8957c94410eb0c2fb983a294b114b37f3e3eb6601917f119d519b235449a97aa720b05bbb57b6a058bf9a33e6f3167200c1d70e785ae335e2

    • SSDEEP

      98304:xIyGHl0VF6q/BtGiCtRdIDGIQc3VMOr4r1JLdwS2z9ZJ9xiQ:xLxVFNJtGi2IDGIQcelz89ZJDd

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks